Add admin subdomain support with IPv6

- Add nginx server blocks for admin.eagle0.net and admin.prod.eagle0.net
- Enable IPv6 listeners on all nginx server blocks
- Remove direct port exposure for admin (now accessed via nginx)
- Admin console will be available at https://admin.eagle0.net

Requires SSL certificate setup after DNS propagation:
  certbot certonly --webroot -w /var/www/certbot \
    -d admin.eagle0.net -d admin.prod.eagle0.net

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker-compose.prod.yml

@@ -137,6 +137,7 @@ services:
       - ./auth:/etc/nginx/auth:ro
     depends_on:
       - eagle
+      - admin
     restart: unless-stopped
     logging:
       driver: "json-file"
@@ -156,8 +157,7 @@ services:
       - "jfr-sidecar:8081"
       - "--http-port"
       - "8080"
-    ports:
-      - "8080:8080"
+    # No external port - accessed via nginx at admin.eagle0.net
     depends_on:
       - eagle
       - auth

nginx/nginx.conf

@@ -33,6 +33,7 @@ http {
     # HTTP server for Let's Encrypt challenge and redirect
     server {
         listen 80;
+        listen [::]:80;
         server_name prod.eagle0.net;
 
         # Let's Encrypt challenge
@@ -49,6 +50,7 @@ http {
     # HTTPS server for gRPC
     server {
         listen 443 ssl;
+        listen [::]:443 ssl;
         http2 on;
         server_name prod.eagle0.net;
 
@@ -125,6 +127,7 @@ http {
     # Clients connect here directly for OAuth RPCs in Phase 2
     server {
         listen 40033 ssl;
+        listen [::]:40033 ssl;
         http2 on;
         server_name prod.eagle0.net;
 
@@ -192,4 +195,54 @@ http {
             return 204;
         }
     }
+
+    # HTTP server for Admin Console (Let's Encrypt + redirect)
+    server {
+        listen 80;
+        listen [::]:80;
+        server_name admin.prod.eagle0.net admin.eagle0.net;
+
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+        }
+
+        # Temporarily serve directly until SSL certs are obtained
+        # After running certbot, uncomment the HTTPS block below and change this to:
+        # return 301 https://$host$request_uri;
+        location / {
+            proxy_pass http://admin:8080;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+        }
+    }
+
+    # HTTPS server for Admin Console
+    # Uncomment after obtaining SSL certs with:
+    #   certbot certonly --webroot -w /var/www/certbot -d admin.eagle0.net -d admin.prod.eagle0.net
+    #
+    # server {
+    #     listen 443 ssl;
+    #     listen [::]:443 ssl;
+    #     server_name admin.prod.eagle0.net admin.eagle0.net;
+    #
+    #     ssl_certificate /etc/letsencrypt/live/admin.eagle0.net/fullchain.pem;
+    #     ssl_certificate_key /etc/letsencrypt/live/admin.eagle0.net/privkey.pem;
+    #
+    #     ssl_protocols TLSv1.2 TLSv1.3;
+    #     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
+    #     ssl_prefer_server_ciphers off;
+    #     ssl_session_timeout 1d;
+    #     ssl_session_cache shared:SSL:10m;
+    #     ssl_session_tickets off;
+    #
+    #     location / {
+    #         proxy_pass http://admin:8080;
+    #         proxy_set_header Host $host;
+    #         proxy_set_header X-Real-IP $remote_addr;
+    #         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    #         proxy_set_header X-Forwarded-Proto $scheme;
+    #     }
+    # }
 }