Update Servers/Documentation/Zensical.md

Servers/Documentation/Zensical.md

@@ -43,11 +43,49 @@ sed -i -E 's/^[[:space:]]*#([[:space:]]*"navigation\.tabs",[[:space:]]*)/\1/' ze
 sed -i -E 's/^[[:space:]]*#([[:space:]]*"navigation\.tabs\.sticky",[[:space:]]*)/\1/' zensical.toml
 ```
 
-### Launch Zensical Server
+### Deploy NGINX Webserver
-At this point, you can simply launch the server via the hotload-friendly `serve` mode.  I have this configured to listen on `0.0.0.0` but you can set it to `localhost` or a LAN IP address like `192.168.3.8`.  You can adjust the port number if you want to.  
+We need to deploy NGINX as a webserver, because when using reverse proxies like Traefik, it seems to not get along with Zensical at all.  Attempts to resolve this all failed, so putting the statically-built copies of site data that Zensical generates into NGINX's root directory is the second-best solution I came up with.  Traefik can be reasonably expected to behave when interacting with NGINX versus Zensical's built-in webserver.
 
 ```sh
-zensical serve -a 0.0.0.0:80
+sudo apt install -y nginx
+sudo rm -f /etc/nginx/sites-enabled/default
+sudo tee /etc/nginx/sites-available/zensical.conf > /dev/null <<'EOF'
+server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    root /srv/zensical/site;
+    index index.html;
+
+    # Primary document handling
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Static asset caching (safe for docs)
+    location ~* \.(css|js|png|jpg|jpeg|gif|svg|ico|woff2?)$ {
+        expires 7d;
+        add_header Cache-Control "public, max-age=604800, immutable";
+        try_files $uri =404;
+    }
+
+    # Prevent access to source or metadata
+    location ~* \.(toml|md)$ {
+        deny all;
+    }
+}
+EOF
+
+sudo ln -s /etc/nginx/sites-available/zensical.conf /etc/nginx/sites-enabled/zensical.conf
+sudo nginx -t
+sudo systemctl reload nginx
+sudo systemctl enable nginx
 ```
 
-mkdir -p /srv/zensical/server
+### Configure Zensical to Hotload Changes
+Since NGINX has taken over hosting the webpages, this does not need to be accessible from other servers, only NGINX itself which runs on the same host as Zensical.  We only want to use the `zensical serve` command to keep a watchdog on the documentation folder and automatically rebuild the static site content when changes are detected.  These changes are then served by NGINX's webserver.  *We don't care about the IP:port exposed by this built-in Zensical server.
+
+```sh
+zensical serve
+```