Merge remote-tracking branch 'origin/main' into security/cloudflare-real-ipsecurity/cloudflare-real-ip

2 files changed, 3 insertions, 50 deletions

diff --git a/ops/README.md b/ops/README.md
index 554f085..0457499 100644
--- a/ops/README.md
+++ b/ops/README.md
@@ -192,8 +192,7 @@ clients still hold; replacing the encryption key invalidates every access token,
 token, so every application has to ask again. Back up both files with the database.
 
 The certificate of `progmasoft.com` must name `credentials.progmasoft.com`, `authorize.progmasoft.com`,
-`console.progmasoft.com`, `product.progmasoft.com`, `ides.progmasoft.com` and `catch3.progmasoft.com` as well; expand
-it with certbot's webroot plugin before the vhosts are enabled, then check
+`console.progmasoft.com`, `product.progmasoft.com` and `catch3.progmasoft.com` as well; expand it with certbot's webroot plugin before the vhosts are enabled, then check
 `/.well-known/openid-configuration`, the sign-in page and the console from outside.
 
 ## Reserved accounts
diff --git a/ops/nginx/progmaweb.conf b/ops/nginx/progmaweb.conf
index daa81ef..f752b80 100644
--- a/ops/nginx/progmaweb.conf
+++ b/ops/nginx/progmaweb.conf
@@ -418,9 +418,8 @@ server {
     }
 }
 
-# The product catalog (product.progmasoft.com) and the product sites Progmaweb
-# serves itself (ides.progmasoft.com, catch3.progmasoft.com): pages of the
-# Next.js site only.
+# The product catalog (product.progmasoft.com) and the product site Progmaweb
+# serves itself (catch3.progmasoft.com): pages of the Next.js site only.
 server {
     listen 80;
     listen [::]:80;
@@ -469,51 +468,6 @@ server {
 server {
     listen 80;
     listen [::]:80;
-    server_name ides.progmasoft.com;
-
-    location ^~ /.well-known/acme-challenge/ {
-        root /var/lib/letsencrypt;
-        default_type text/plain;
-    }
-
-    location / {
-        return 308 https://ides.progmasoft.com$request_uri;
-    }
-}
-
-server {
-    listen 443 ssl;
-    listen [::]:443 ssl;
-    http2 on;
-    server_name ides.progmasoft.com;
-
-    ssl_certificate /etc/letsencrypt/live/progmasoft.com/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/progmasoft.com/privkey.pem;
-    include /etc/letsencrypt/options-ssl-nginx.conf;
-
-    client_max_body_size 1m;
-
-    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-Frame-Options "DENY" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
-
-    location / {
-        proxy_pass http://127.0.0.1:3010;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_read_timeout 60s;
-    }
-}
-
-server {
-    listen 80;
-    listen [::]:80;
     server_name catch3.progmasoft.com;
 
     location ^~ /.well-known/acme-challenge/ {