change layout of login

deploy/nginx/README.md

@@ -0,0 +1,51 @@
+# Dedicated-server reverse proxy
+
+Production exposes the CMS application through Kubernetes NodePort `31373`.
+
+## DNS
+
+In one.com, create an `A` record for `cms.urpi.be` pointing to the dedicated
+server's public IPv4 address. Add an `AAAA` record only when the server and its
+firewall are configured for public IPv6. Wait for:
+
+```bash
+dig +short cms.urpi.be
+```
+
+to return the dedicated server address before requesting a certificate.
+
+## Nginx and Certbot
+
+The included virtual host assumes Nginx runs on the Kubernetes node and can
+reach the NodePort at `127.0.0.1:31373`.
+
+```bash
+sudo install -m 0644 deploy/nginx/cms.urpi.be.conf \
+  /etc/nginx/sites-available/cms.urpi.be.conf
+sudo ln -s /etc/nginx/sites-available/cms.urpi.be.conf \
+  /etc/nginx/sites-enabled/cms.urpi.be.conf
+sudo nginx -t
+sudo systemctl reload nginx
+sudo certbot --nginx -d cms.urpi.be
+sudo certbot renew --dry-run
+```
+
+Certbot adds the HTTPS listener, certificate paths, and HTTP-to-HTTPS redirect
+to this virtual host. Allow inbound TCP ports `80` and `443`. Do not expose
+NodePort `31373` to the public internet. If Nginx is not on a Kubernetes node, replace
+`127.0.0.1` in `proxy_pass` with a private cluster-node address and allow
+`31373` only from the Nginx server.
+
+## Deploy and verify
+
+Deploy the production profile:
+
+```bash
+make helm-deploy-production
+kubectl -n cms-production get pods
+kubectl -n cms-production get service cms
+curl --fail http://127.0.0.1:31373/health
+curl --fail https://cms.urpi.be/health
+```
+
+The `cms` service should show `80:31373/TCP`.

deploy/nginx/cms.urpi.be.conf

@@ -0,0 +1,21 @@
+server {
+    listen 80;
+    listen [::]:80;
+    server_name cms.urpi.be;
+
+    client_max_body_size 10m;
+
+    location / {
+        proxy_pass http://127.0.0.1:31373;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Connection "";
+        proxy_buffering off;
+        proxy_request_buffering off;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+}