Route payment bank callbacks through storefront domains.

ZarinPal rejects api.meshkee.com when the terminal is registered to the store apex; nginx now proxies /meshkee/payments/{gateway}/callback to a host-scoped API route.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/websites-agent/README.md

@@ -11,6 +11,7 @@
 #
 # Scripts on the VM (same folder):
 #   patch-nginx-seo.sh <host>  — add /sitemap.xml + /robots.txt API proxies to an existing nginx site
+#   patch-nginx-pay.sh <host>  — add /meshkee/payments/{zarinpal|mellat}/callback API proxies
 #
 # Env (.env): PORT, DEPLOY_TOKEN, ALLOWED_SLUGS
 #

scripts/websites-agent/patch-nginx-pay.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# Insert / update Meshkee payment-callback proxy locations on a storefront nginx site.
+# Bank gateways (ZarinPal/Mellat) hit https://{host}/meshkee/payments/{gateway}/callback
+# which proxies to the API tenant callback route.
+set -euo pipefail
+
+HOST="${1:-}"
+API_HOST="${MESHKEE_API_HOST:-api.meshkee.com}"
+
+if [[ -z "$HOST" ]]; then
+  echo "usage: patch-nginx-pay.sh <host>" >&2
+  exit 1
+fi
+
+NGINX_AVAILABLE="/etc/nginx/sites-available/$HOST"
+
+if [[ ! -f "$NGINX_AVAILABLE" ]]; then
+  echo "missing nginx site for $HOST" >&2
+  exit 1
+fi
+
+proxy_location() {
+  local gateway="$1"
+  local path="/meshkee/payments/${gateway}/callback"
+  cat <<NGINX
+    location = ${path} {
+        proxy_pass https://${API_HOST}/api/v1/tenants/${HOST}/payments/${gateway}/callback;
+        proxy_set_header Host ${API_HOST};
+        proxy_ssl_server_name on;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_pass_request_body on;
+        proxy_pass_request_headers on;
+    }
+
+NGINX
+}
+
+ensure_location() {
+  local gateway="$1"
+  local path="/meshkee/payments/${gateway}/callback"
+  if grep -qF "location = ${path}" "$NGINX_AVAILABLE"; then
+    echo "already present: ${path}"
+    return 0
+  fi
+
+  local block
+  block="$(proxy_location "$gateway")"
+  local tmp
+  tmp="$(mktemp)"
+  awk -v block="$block" '
+    /location \/ \{/ && !done {
+      print block
+      done = 1
+    }
+    { print }
+  ' "$NGINX_AVAILABLE" >"$tmp"
+  mv "$tmp" "$NGINX_AVAILABLE"
+  echo "added: ${path}"
+}
+
+ensure_location zarinpal
+ensure_location mellat
+
+nginx -t
+systemctl reload nginx
+echo "patched nginx payment callback locations for $HOST"

scripts/websites-agent/provision.sh

@@ -162,6 +162,28 @@ server {
         add_header Cache-Control "public, max-age=900";
     }
 
+    location = /meshkee/payments/zarinpal/callback {
+        proxy_pass https://api.meshkee.com/api/v1/tenants/${HOST}/payments/zarinpal/callback;
+        proxy_set_header Host api.meshkee.com;
+        proxy_ssl_server_name on;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_pass_request_body on;
+        proxy_pass_request_headers on;
+    }
+
+    location = /meshkee/payments/mellat/callback {
+        proxy_pass https://api.meshkee.com/api/v1/tenants/${HOST}/payments/mellat/callback;
+        proxy_set_header Host api.meshkee.com;
+        proxy_ssl_server_name on;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_pass_request_body on;
+        proxy_pass_request_headers on;
+    }
+
     location / {
         proxy_pass http://127.0.0.1:${PORT};
         proxy_http_version 1.1;
@@ -185,6 +207,9 @@ else
   if [[ -x "$SCRIPT_DIR/patch-nginx-seo.sh" ]]; then
     "$SCRIPT_DIR/patch-nginx-seo.sh" "$HOST" || true
   fi
+  if [[ -x "$SCRIPT_DIR/patch-nginx-pay.sh" ]]; then
+    "$SCRIPT_DIR/patch-nginx-pay.sh" "$HOST" || true
+  fi
 fi
 
 # SSL is issued separately via ssl.sh / Super Admin "Issue SSL" — do not run