# nginx reverse proxy for the LPRA server.
# TLS is terminated here; the Go server listens on 127.0.0.1:8091.
#
# Put this in /etc/nginx/sites-available/lp_agent and symlink it into
# sites-enabled, then:  sudo nginx -t && sudo systemctl reload nginx
#
# Everything (agent + browser terminal) is plain HTTP long-polling, so NO
# WebSocket config is needed. The two settings that matter:
#   - proxy_buffering off      -> deliver long-poll responses immediately
#   - proxy_read_timeout 120s  -> longer than the 25s long-poll hold
#
# NOTE: proxy_pass MUST start with "http://". A bare "proxy_pass 127.0.0.1:8091;"
# causes nginx error:  [emerg] invalid URL prefix.

server {
    listen 8445 ssl;
    server_name REDACTED;

    ssl_certificate /etc/letsencrypt/live/REDACTED/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/REDACTED/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    # Files go through the panel in 4 MB pieces; 64m leaves room for a client
    # older than 0.0.8, which takes a file of up to 32 MB in one request.
    client_max_body_size 64m;

    location / {
        proxy_pass http://127.0.0.1:8091;

        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Long-poll behaviour: no buffering, generous read timeout.
        proxy_buffering     off;
        proxy_cache         off;
        # Pass uploads on as they arrive: the speed test through the browser
        # times them on the client.
        proxy_request_buffering off;
        proxy_read_timeout  300s;
        proxy_send_timeout  300s;
    }
}