feat: initial commit

deploy/nginx.conf.example

@@ -0,0 +1,42 @@
+# nginx reverse proxy for the LPRA server.
+# TLS is terminated here; the Go server listens on 127.0.0.1:8091.
+#
+# Put this in /etc/nginx/sites-available/lp_agent and symlink it into
+# sites-enabled, then:  sudo nginx -t && sudo systemctl reload nginx
+#
+# Everything (agent + browser terminal) is plain HTTP long-polling, so NO
+# WebSocket config is needed. The two settings that matter:
+#   - proxy_buffering off      -> deliver long-poll responses immediately
+#   - proxy_read_timeout 120s  -> longer than the 25s long-poll hold
+#
+# NOTE: proxy_pass MUST start with "http://". A bare "proxy_pass 127.0.0.1:8091;"
+# causes nginx error:  [emerg] invalid URL prefix.
+
+server {
+    listen 8445 ssl;
+    server_name REDACTED;
+
+    ssl_certificate /etc/letsencrypt/live/REDACTED/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/REDACTED/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    # Agent binaries can be large; allow the download.
+    client_max_body_size 64m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8091;
+
+        proxy_http_version 1.1;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Long-poll behaviour: no buffering, generous read timeout.
+        proxy_buffering     off;
+        proxy_cache         off;
+        proxy_read_timeout  120s;
+        proxy_send_timeout  120s;
+    }
+}