snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

puppet/kandra/files/nginx/sites-available/zulip

@@ -0,0 +1,35 @@
+server {
+    # If coming from localhost, we do allow access to internal
+    # APIs over HTTP.
+    listen 127.0.0.1:80;
+    listen [::1]:80;
+
+    location /api/internal/ {
+        include /etc/nginx/zulip-include/api_headers;
+        include uwsgi_params;
+    }
+}
+
+include /etc/nginx/zulip-include/trusted-ip;
+include /etc/nginx/zulip-include/trusted-proto;
+include /etc/nginx/zulip-include/s3-cache;
+include /etc/nginx/zulip-include/upstreams;
+include /etc/zulip/nginx_sharding_map.conf;
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    # This server is behind an ALB, which does not check the
+    # certificate validity:
+    # https://kevin.burke.dev/kevin/aws-alb-validation-tls-reply/
+    #
+    # Snakeoil verts are good for 10 years after initial creation, but
+    # the ALBs don't even check expiration. ¯\_(ツ)_/¯
+    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+
+    server_name zulipchat.com *.zulipchat.com;
+
+    include /etc/nginx/zulip-include/app;
+}

puppet/kandra/files/nginx/sites-available/zulip-staging

@@ -0,0 +1,35 @@
+server {
+    # If coming from localhost, we do allow access to internal
+    # APIs over HTTP.
+    listen 127.0.0.1:80;
+    listen [::1]:80;
+
+    location /api/internal/ {
+        include /etc/nginx/zulip-include/api_headers;
+        include uwsgi_params;
+    }
+}
+
+include /etc/nginx/zulip-include/trusted-ip;
+include /etc/nginx/zulip-include/trusted-proto;
+include /etc/nginx/zulip-include/s3-cache;
+include /etc/nginx/zulip-include/upstreams;
+include /etc/zulip/nginx_sharding_map.conf;
+
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    # This server is behind an ALB, which does not check the
+    # certificate validity:
+    # https://kevin.burke.dev/kevin/aws-alb-validation-tls-reply/
+    #
+    # Snakeoil verts are good for 10 years after initial creation, but
+    # the ALBs don't even check expiration. ¯\_(ツ)_/¯
+    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
+    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
+
+    server_name zulipstaging.com;
+
+    include /etc/nginx/zulip-include/app;
+}

puppet/kandra/files/nginx/zulip-include-app.d/navigation-tour-video.conf

@@ -0,0 +1,9 @@
+location /static/navigation-tour-video/ {
+    alias /home/zulip/prod-static/navigation-tour-video/;
+    error_page 404 /django_static_404.html;
+    include /etc/nginx/zulip-include/immutable_headers;
+}
+
+location = /static/navigation-tour-video/zulip-10.mp4 {
+    return 302 fffe1bb0baefab1a448fd9082738eaf271feb7ec247901242cd7bccb2280914b.mp4;
+}

puppet/kandra/files/nginx/zulip-include-app.d/well-known.conf

@@ -0,0 +1,3 @@
+location /.well-known/ {
+    alias /etc/zulip/well-known/;
+}