inventory/group_vars/all.yml

@@ -119,6 +119,10 @@ app_catalog:
     # Document root served by nginx and written by `npm run build:<env>`.
     # {env} is replaced with the entry's env (beta/prod).
     webroot_pattern: "/var/www/{env}.chat.aimloperations/html"
+    # hesychia.ai Stripe/RevenueCat webhooks hit this vhost. Proxy the prefix
+    # to chat_backend so POST is not answered 405 by the SPA index.html.
+    api_backend: chat_backend
+    api_proxy_prefix: /api/finance/webhooks/
     # /robots.txt, /sitemap.xml, and /llms.txt must not fall through to index.html.
     exact_root_files: true
   chat_backend:
@@ -128,6 +132,11 @@ app_catalog:
     compose_file: docker-compose.prod.yml
     web_service: web
     migrate_cmd: "uv run python manage.py migrate --noinput"
+    # Host header the static-site webhook proxy sends. Must be in Django
+    # ALLOWED_HOSTS (see chat_backend DJANGO_ALLOWED_HOSTS).
+    public_hosts:
+      prod: chatbackend.aimloperations.com
+      beta: beta.chatbackend.aimloperations.com
   monica_site:
     type: django
     repo: "{{ git_base_url }}/ai_ml_operations/monica_site.git"

roles/web-static/templates/docker-compose.yml.j2

@@ -3,6 +3,9 @@ services:
   web-static:
     image: {{ web_static_image }}
     restart: unless-stopped
+    # Webhook locations proxy to chat_backend on the host-published port.
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     logging:
       driver: json-file
       options:

roles/web-static/templates/nginx.conf.j2

@@ -30,6 +30,34 @@ server {
     root {{ (app_catalog[a.name].webroot_pattern | default(web_static_root ~ '/{env}_' ~ a.name)) | replace('{env}', a.env) }};
     index index.html;
 
+{%- set api_backend_name = app_catalog[a.name].api_backend | default('') %}
+{%- if api_backend_name %}
+{%- set api_proxy_prefix = app_catalog[a.name].api_proxy_prefix | default('/api/') %}
+{%- set api_match = namespace(port=0, ok=false) %}
+{%- for item in host_apps | default([]) %}
+{%- if item.name == api_backend_name and item.env == a.env and (item.enabled | default(true)) %}
+{%- set api_match.port = item.port %}
+{%- set api_match.ok = true %}
+{%- endif %}
+{%- endfor %}
+{%- if api_match.ok %}
+{%- set api_host = (app_catalog[api_backend_name].public_hosts | default({}))[a.env] | default('') %}
+
+    # Finance webhooks (Stripe) arrive on the public product host. The SPA
+    # try_files fallback is a static file and returns 405 for POST.
+    location {{ api_proxy_prefix }} {
+        proxy_pass http://host.docker.internal:{{ api_match.port }};
+        proxy_http_version 1.1;
+        proxy_set_header Host {{ api_host if api_host else '$host' }};
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 60s;
+        client_max_body_size 2m;
+    }
+{%- endif %}
+{%- endif %}
+
 {% if app_catalog[a.name].exact_root_files | default(false) %}
     # Crawlers must get these files, never the SPA index.html fallback.
     location = /robots.txt {