adding default nginx conf

deploy/README.md

@@ -62,26 +62,21 @@ journalctl -u pps -f          # startup + request logs (also in /opt/pps-quarant
 curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/login   # -> 200
 ```
 
-## Reverse proxy (TLS)
-
-Terminate TLS at nginx/Caddy and proxy to `127.0.0.1:8080`. Make sure the Okta
-`redirect_uri` matches the public HTTPS URL exactly (e.g.
-`https://pps.internal.example.com/authorize`). Minimal nginx:
-
-```nginx
-server {
-    listen 443 ssl;
-    server_name pps.internal.example.com;
-    ssl_certificate     /etc/ssl/pps.crt;
-    ssl_certificate_key /etc/ssl/pps.key;
-    location / {
-        proxy_pass http://127.0.0.1:8080;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Proto https;
-    }
-}
+## Reverse proxy (nginx + TLS)
+
+A ready-made site config is in [`pps.nginx.conf`](pps.nginx.conf) — it terminates TLS and
+`proxy_pass`es to `127.0.0.1:8080`. Edit the `server_name` and `ssl_certificate*` paths, then:
+
+```bash
+sudo cp deploy/pps.nginx.conf /etc/nginx/sites-available/pps
+sudo ln -s /etc/nginx/sites-available/pps /etc/nginx/sites-enabled/pps
+sudo nginx -t && sudo systemctl reload nginx
 ```
 
+Make sure the Okta `redirect_uri` matches the public HTTPS URL exactly (e.g.
+`https://pps.internal.example.com/authorize`), and set `[app] cookie_secure = true` and
+`listen = "127.0.0.1"` in `config.toml`.
+
 ## Day-to-day
 
 ```bash

deploy/pps.nginx.conf

@@ -0,0 +1,32 @@
+# nginx reverse proxy for the PPS Quarantine Manager.
+#
+# Install (Debian):
+#   sudo cp deploy/pps.nginx.conf /etc/nginx/sites-available/pps
+#   sudo ln -s /etc/nginx/sites-available/pps /etc/nginx/sites-enabled/pps
+#   sudo nginx -t && sudo systemctl reload nginx
+#
+# The app listens on 127.0.0.1:8080 (set [app] listen/port in config.toml). nginx
+# terminates TLS and forwards to it. Set [app] cookie_secure = true behind TLS.
+
+server {
+    listen 80;
+    server_name pps.internal.example.com;      # <-- your hostname
+    # Redirect all HTTP to HTTPS.
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl;
+    server_name pps.internal.example.com;      # <-- your hostname
+
+    ssl_certificate     /etc/ssl/pps.crt;      # <-- your TLS cert
+    ssl_certificate_key /etc/ssl/pps.key;      # <-- your TLS key
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}