# nginx reverse proxy for the PPS Quarantine Manager.
#
# Install (Debian):
#   sudo cp deploy/ppsq.nginx.conf /etc/nginx/sites-available/ppsq
#   sudo ln -s /etc/nginx/sites-available/ppsq /etc/nginx/sites-enabled/ppsq
#   sudo nginx -t && sudo systemctl reload nginx
#
# The app listens on 127.0.0.1:8080 (set [app] listen/port in config.toml). nginx
# terminates TLS and forwards to it. Set [app] cookie_secure = true behind TLS.

server {
    listen 80;
    server_name ppsq.internal.example.com;      # <-- your hostname
    # Redirect all HTTP to HTTPS.
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name ppsq.internal.example.com;      # <-- your hostname

    ssl_certificate     /etc/ssl/ppsq.crt;      # <-- your TLS cert
    ssl_certificate_key /etc/ssl/ppsq.key;      # <-- your TLS key

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}