# Lodger behind nginx. Put this file in /etc/nginx/conf.d/, then change the
# server name, the certificate paths, and the proxy_pass address to yours.
# scripts/proxy-smoke.sh tests this file in CI, with only the port and the
# proxy_pass address changed.

# The events socket and the console need the WebSocket upgrade.
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl;
    server_name lodger.example.lan;

    ssl_certificate     /etc/nginx/certs/lodger.crt;
    ssl_certificate_key /etc/nginx/certs/lodger.key;

    location / {
        # Lodger on the same host, on its default loopback address. For
        # Lodger on a Docker bridge address, write that address here.
        proxy_pass http://127.0.0.1:8460;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        # Lodger reads the client address from X-Real-IP, but only when the
        # request comes from an address in its trusted_proxies. Setting the
        # header here replaces any X-Real-IP that the client sent.
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        # The events socket stays open while a page is open.
        proxy_read_timeout 1h;
    }
}