OPC # 0002: Improvements to Client provisioning workflows

infra/dnsmasq/dnsmasq.conf

@@ -0,0 +1,10 @@
+# Resolve *.clarity.test → 127.0.0.1 so browser hits nginx on the host
+address=/.clarity.test/127.0.0.1
+
+# Don't read /etc/resolv.conf or /etc/hosts
+no-resolv
+no-hosts
+
+# Forward everything else to Cloudflare
+server=1.1.1.1
+server=1.0.0.1

infra/nginx/nginx.conf

@@ -0,0 +1,24 @@
+events {
+    worker_connections 1024;
+}
+
+http {
+    # Use Docker embedded DNS so container names resolve dynamically
+    resolver 127.0.0.11 valid=5s ipv6=off;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent"';
+
+    access_log /var/log/nginx/access.log main;
+    error_log  /var/log/nginx/error.log warn;
+
+    # HTTP → HTTPS redirect
+    server {
+        listen 80 default_server;
+        return 301 https://$host$request_uri;
+    }
+
+    # Per-tenant server blocks dropped by provisioning worker
+    include /etc/nginx/conf.d/*.conf;
+}