--- a/etc/nginx/apps.conf	2026-06-10 16:57:53.240415810 +0200
+++ b/etc/nginx/apps.conf	2026-06-10 16:57:53.246704804 +0200
@@ -1,23 +1,137 @@
-#		location /app/androidcast_project/build/ {
-#		 	proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/build/;
-#		}
-
-		# Redirect without trailing slash
-		location = /app/androidcast_project/build {
-		    return 301 $scheme://$host/app/androidcast_project/build/;
-		}
-		location /app/androidcast_project/build/ {
-		    proxy_pass http://artc0.intra.raptor.org:80;
-		    proxy_http_version 1.1;
-		    proxy_set_header Host              $host;
-		    proxy_set_header X-Real-IP         $remote_addr;
-		    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-		    proxy_set_header X-Forwarded-Proto $scheme;
-		    proxy_set_header X-Forwarded-Host  $host;
-		    proxy_set_header Upgrade    $http_upgrade;
-		    proxy_set_header Connection $connection_upgrade;
-		    proxy_read_timeout  1800s;
-		    proxy_send_timeout  1800s;
-		    client_max_body_size 512m;
-		}
+# apps.f0xx.org — Android Cast public vhost (FE Gentoo).
+# Included from nginx.conf:  include /etc/nginx/apps.conf;
+#
+# Upstream: BE nginx on artc0.intra.raptor.org:80 (hub PHP, crashes, graphs, build, OTA).
+# Git browser: BE :3000 (Gitea).  Do not proxy androidcast to BE :443 or :8089.
+#
+# Reload:  nginx -t && rc-service nginx reload
 
+server {
+	listen 80;
+	server_name apps.f0xx.org;
+	return 301 https://$host$request_uri;
+}
+
+server {
+	listen 443 ssl http2;
+	server_name apps.f0xx.org;
+
+	access_log /var/log/nginx/apps.intra.raptor.org.access_log main;
+	error_log /var/log/nginx/apps.intra.raptor.org.error_log info;
+
+	ssl_certificate /etc/letsencrypt/live/apps.f0xx.org/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/apps.f0xx.org/privkey.pem;
+
+	# --- OTA artifacts (BE static tree on listen 80) ---
+	location ^~ /v0/ota/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	# --- APK builder (long-running Docker builds) ---
+	location = /app/androidcast_project/build {
+		return 301 $scheme://$host/app/androidcast_project/build/;
+	}
+	location ^~ /app/androidcast_project/build/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	# --- Crash / ticket console ---
+	location = /app/androidcast_project/crashes {
+		return 301 $scheme://$host/app/androidcast_project/crashes/;
+	}
+	location ^~ /app/androidcast_project/crashes/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		client_max_body_size 16m;
+	}
+
+	# --- Graphs dashboard ---
+	location = /app/androidcast_project/graphs {
+		return 301 $scheme://$host/app/androidcast_project/graphs/;
+	}
+	location ^~ /app/androidcast_project/graphs/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	# --- Hub landing (PHP index) ---
+	location = /app/androidcast_project {
+		return 301 $scheme://$host/app/androidcast_project/;
+	}
+	location ^~ /app/androidcast_project/ {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+	}
+
+	# --- Gitea web UI ---
+	location = /app/androidcast_project/git {
+		return 301 $scheme://$host/app/androidcast_project/git/;
+	}
+	location ^~ /app/androidcast_project/git/ {
+		proxy_pass http://artc0.intra.raptor.org:3000/;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_set_header X-Forwarded-Host $host;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_read_timeout 1800s;
+		proxy_send_timeout 1800s;
+		client_max_body_size 512m;
+	}
+
+	# --- Default: anything else on this vhost → BE :80 ---
+	location / {
+		proxy_pass http://artc0.intra.raptor.org:80;
+		proxy_http_version 1.1;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto $scheme;
+		proxy_connect_timeout 120s;
+		proxy_send_timeout 120s;
+		proxy_read_timeout 180s;
+		proxy_buffers 16 16m;
+		proxy_buffer_size 16m;
+		client_body_buffer_size 16m;
+		client_max_body_size 16m;
+		proxy_buffering off;
+		proxy_set_header Upgrade $http_upgrade;
+		proxy_set_header Connection $connection_upgrade;
+		proxy_cache_bypass $http_upgrade;
+	}
+
+	location ~ /\.ht {
+		deny all;
+	}
+}
--- a/etc/nginx/nginx.conf	2026-06-10 16:57:52.277069336 +0200
+++ b/etc/nginx/nginx.conf	2026-06-10 16:57:53.277208423 +0200
@@ -918,104 +918,8 @@
 
 
 ## -------------------------------------------------------------------------------
+## apps.f0xx.org — Android Cast (hub, crashes, graphs, build, OTA, git)
+	include /etc/nginx/apps.conf;
 
-        server {
-      		listen 80;
-          	server_name apps.f0xx.org;
-	      	location / {
-			rewrite ^(.*)$ https://apps.f0xx.org$1 permanent;
-		}
-		# redirects both www and non-www to https
-		return 301 https://apps.f0xx.org$request_uri;
-	}			
-	server {
-    		listen 443 ssl http2;
-    		server_name apps.f0xx.org;
-
-    		access_log /var/log/nginx/apps.intra.raptor.org.access_log main;
-    		error_log /var/log/nginx/apps.intra.raptor.org.error_log info;
-
-		ssl_certificate /etc/letsencrypt/live/apps.f0xx.org/fullchain.pem;
-		ssl_certificate_key /etc/letsencrypt/live/apps.f0xx.org/privkey.pem;
-
-	        location / {
-	       		proxy_pass http://artc0.intra.raptor.org:80;
-	       		proxy_set_header Host $host;
-        		proxy_set_header X-Real-IP $remote_addr;
-        		proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
-        		proxy_set_header X-Forwarded-Proto $scheme;
-        		proxy_connect_timeout 120;
-        		proxy_send_timeout    120;
-        		proxy_read_timeout    180;
-        		proxy_buffers 16 16M;
-        		proxy_buffer_size 16M;
-        		client_body_buffer_size 16M;
-        		client_max_body_size 16M;
-			proxy_buffering off;
-			proxy_set_header   Upgrade $http_upgrade;
-			proxy_set_header   Connection keep-alive;
-			proxy_set_header   Host $host;
-			proxy_cache_bypass $http_upgrade;
-			proxy_set_header Connection "upgrade";
-		}
-
-		#location /app/androidcast_project/ {
-		# 	proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/;
-		#}
-#
-#		location /app/androidcast_project/crashes/ {
-#		 	proxy_pass https://artc0.intra.raptor.org/app/androidcast_project/crashes/;
-#		}
-#
-
-		location /app/androidcast_project/ {
-			proxy_pass http://artc0.intra.raptor.org:80;
-			proxy_http_version 1.1;
-			proxy_set_header Host              $host;
-			proxy_set_header X-Real-IP         $remote_addr;
-			proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-			proxy_set_header X-Forwarded-Proto $scheme;
-		}
-
-		location /app/androidcast_project/crashes/ {
-			proxy_pass http://artc0.intra.raptor.org:80;
-			proxy_http_version 1.1;
-			proxy_set_header Host              $host;
-			proxy_set_header X-Real-IP         $remote_addr;
-			proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-			proxy_set_header X-Forwarded-Proto $scheme;
-		}
-
-		include /etc/nginx/apps.conf;
-
-    		location ~ /\.ht {
-        		deny all;
-    		}	
-
-		root /var/www/localhost/htdocs/android_cast/project/android_cast/examples/crash_reporter/backend/public/;
-		index index.php;
-
-
-## gitea redirection
-# Redirect without trailing slash
-		location = /app/androidcast_project/git {
-		    return 301 $scheme://$host/app/androidcast_project/git/;
-		}
-		location /app/androidcast_project/git/ {
-		    proxy_pass http://artc0.intra.raptor.org:3000/;
-		    proxy_http_version 1.1;
-		    proxy_set_header Host              $host;
-		    proxy_set_header X-Real-IP         $remote_addr;
-		    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-		    proxy_set_header X-Forwarded-Proto $scheme;
-		    proxy_set_header X-Forwarded-Host  $host;
-		    proxy_set_header Upgrade    $http_upgrade;
-		    proxy_set_header Connection $connection_upgrade;
-		    proxy_read_timeout  1800s;
-		    proxy_send_timeout  1800s;
-		    client_max_body_size 512m;
-		}
-
-	}
 
 }
