refactor(infra): nginx conf envsubst template, no more hardcoded ports/domains

- Rename bcsd-api.conf → bcsd-api.conf.template with ${VAR} placeholders
- deploy.sh renders template via envsubst before nginx install
- All ports (API_BLUE_PORT, API_GREEN_PORT, N8N_PORT, FRONTEND_PORT)
  and domains (DOMAIN, N8N_DOMAIN, FRONTEND_DOMAIN) from .env
- Add FRONTEND_PORT=3080 to .env.example
- Generated .conf added to .gitignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ImTotem

.env.example

@@ -44,6 +44,8 @@ API_BLUE_PORT=8001
 API_GREEN_PORT=8002
 # n8n 호스트 포트
 N8N_PORT=5678
+# 프론트엔드 호스트 포트
+FRONTEND_PORT=3080
 # Graceful shutdown 대기 시간 (초)
 GRACEFUL_TIMEOUT=10
 

.gitignore

@@ -511,5 +511,8 @@ $RECYCLE.BIN/
 !package.json
 !tsconfig.json
 
+# Generated nginx conf (envsubst output from .template)
+infra/nginx/bcsd-api.conf
+
 # End of https://www.toptal.com/developers/gitignore/api/intellij+all,pycharm+all,visualstudiocode,python,pythonvanilla,macos,windows,linux,git,jetbrains+all
 

infra/nginx/bcsd-api.conf infra/nginx/bcsd-api.conf.templateinfra/nginx/bcsd-api.conf renamed to infra/nginx/bcsd-api.conf.template

@@ -4,25 +4,25 @@ map $http_upgrade $connection_upgrade {
 }
 
 upstream api_blue {
-    server 127.0.0.1:8001;
+    server 127.0.0.1:${API_BLUE_PORT};
 }
 
 upstream api_green {
-    server 127.0.0.1:8002;
+    server 127.0.0.1:${API_GREEN_PORT};
 }
 
 upstream n8n {
-    server 127.0.0.1:5678;
+    server 127.0.0.1:${N8N_PORT};
 }
 
 upstream frontend {
-    server 127.0.0.1:3080;
+    server 127.0.0.1:${FRONTEND_PORT};
 }
 
 # --- HTTP: ACME + redirect ---
 server {
     listen 80;
-    server_name api.bcsdlab.com n8n.bcsdlab.com stage.bcsdlab.com;
+    server_name ${DOMAIN} ${N8N_DOMAIN} ${FRONTEND_DOMAIN};
 
     location /.well-known/acme-challenge/ {
         root /var/www/certbot;
@@ -36,7 +36,7 @@ server {
 # --- HTTPS: API ---
 server {
     listen 443 ssl http2;
-    server_name api.bcsdlab.com;
+    server_name ${DOMAIN};
 
     ssl_certificate /etc/letsencrypt/live/bcsdlab.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/bcsdlab.com/privkey.pem;
@@ -76,7 +76,7 @@ server {
 # --- HTTPS: Frontend ---
 server {
     listen 443 ssl http2;
-    server_name stage.bcsdlab.com;
+    server_name ${FRONTEND_DOMAIN};
 
     ssl_certificate /etc/letsencrypt/live/bcsdlab.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/bcsdlab.com/privkey.pem;
@@ -126,7 +126,7 @@ server {
 # --- HTTPS: n8n ---
 server {
     listen 443 ssl http2;
-    server_name n8n.bcsdlab.com;
+    server_name ${N8N_DOMAIN};
 
     ssl_certificate /etc/letsencrypt/live/bcsdlab.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/bcsdlab.com/privkey.pem;

infra/scripts/deploy.sh

@@ -3,14 +3,16 @@ set -euo pipefail
 
 COMPOSE="sudo docker compose -p bcsd-app --env-file .env -f infra/docker/docker-compose.yml"
 COMPOSE_DB="sudo docker compose -p bcsd-db --env-file .env -f infra/docker/docker-compose.db.yml"
+NGINX_TEMPLATE="infra/nginx/bcsd-api.conf.template"
 NGINX_CONF="infra/nginx/bcsd-api.conf"
 NGINX_AVAILABLE="/etc/nginx/sites-available/bcsd-api.conf"
 NGINX_ENABLED="/etc/nginx/sites-enabled/bcsd-api.conf"
 HEALTH_PATH="/openapi.json"
 MAX_RETRIES=10
+ENVSUBST_VARS='${API_BLUE_PORT} ${API_GREEN_PORT} ${N8N_PORT} ${FRONTEND_PORT} ${DOMAIN} ${N8N_DOMAIN} ${FRONTEND_DOMAIN}'
 
 current_slot() {
-    grep proxy_pass "$NGINX_CONF" | grep -q "api_blue" && echo "blue" || echo "green"
+    grep proxy_pass "$NGINX_CONF" 2>/dev/null | grep -q "api_blue" && echo "blue" || echo "green"
 }
 
 next_slot() {
@@ -49,13 +51,20 @@ check_credentials() {
     fi
 }
 
+render_nginx() {
+    set -a; source .env; set +a
+    envsubst "$ENVSUBST_VARS" < "$NGINX_TEMPLATE" > "$NGINX_CONF"
+}
+
 echo "=== BCSD API Blue-Green Deploy ==="
 
 check_credentials
 
 echo "0. Ensuring DB services..."
 $COMPOSE_DB up -d
 
+render_nginx
+
 CURRENT=$(current_slot)
 NEXT=$(next_slot)