feat: route VIF production traffic

[kaanyagci]

Summary

• add vif.io nginx route to the shared production proxy
• connect proxy to the VIF app overlay network
• include VIF site template in deployment bundle
• reject deployments configured with DEPLOY_SSH_USER=root

Deployment note

• The deploy workflow now requires DEPLOY_SSH_USER to be a non-root SSH user.

Verification

• branch was already pushed; deployment depends on production environment secrets

[Copilot]

Pull request overview

This PR extends the shared production Nginx proxy stack to route traffic for vif.io by adding a dedicated Nginx site template, wiring the proxy service into the VIF application overlay network, and ensuring the new template is included in the deployment bundle.

Changes:

• Added a new vif.io Nginx vhost template with HTTP→HTTPS redirect, ACME challenge handling, and HTTPS reverse proxying to the VIF upstream.
• Connected the proxy to a new external production overlay network (vif_prod_app) for service discovery to the VIF upstream.
• Updated the GitHub Actions deployment workflow to require and deploy the VIF network configuration and template.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sites/vif-prod.conf.template	Adds Nginx vhost config for vif.io (ACME + redirect + TLS reverse proxy).
envs/production/compose.yml	Declares the external vif_prod_app overlay network for production deploys.
envs/production/.env.proxy	Adds production VIF_* environment variables (server name, upstream, TLS paths).
compose.yml	Bundles the new VIF site template config and attaches Nginx to vif_prod_app.
.github/workflows/manual-deploy.yml	Includes VIF template in the deployment bundle and requires the VIF network secret.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.