ANW-19 deployment: systemd unit and reverse-proxy example

deploy/nginx.example.conf

@@ -0,0 +1,53 @@
+# Example nginx reverse proxy in front of Anwesen.
+#
+# Anwesen binds 127.0.0.1:8080 and ships no authentication: if a request
+# reaches it, it may read everything indexed (ADR-007). This proxy is the
+# access boundary -- it terminates TLS, routes by host, and authenticates the
+# client before anything reaches the daemon.
+#
+# Drop into /etc/nginx/sites-available/ (or conf.d/) and adjust the marked
+# values: server_name, certificate paths, and the auth block.
+
+upstream anwesen {
+    server 127.0.0.1:8080;
+}
+
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2 on;
+
+    # --- Host-based routing: only this name reaches Anwesen ---
+    server_name vault.example.org;
+
+    # --- TLS termination ---
+    ssl_certificate     /etc/ssl/anwesen/fullchain.pem;
+    ssl_certificate_key /etc/ssl/anwesen/privkey.pem;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    # --- Client authentication ---
+    # Pick one. HTTP basic auth is the simplest:
+    auth_basic           "Anwesen";
+    auth_basic_user_file /etc/nginx/anwesen.htpasswd;   # htpasswd -c ... anwesen
+    #
+    # For mutual TLS instead, drop the two auth_basic lines and use:
+    #   ssl_client_certificate /etc/ssl/anwesen/clients-ca.pem;
+    #   ssl_verify_client on;
+
+    location / {
+        proxy_pass http://anwesen;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # Anwesen serves strong ETags and honors If-None-Match; nginx forwards
+        # both unchanged, so conditional requests keep working through the proxy.
+    }
+}
+
+# Redirect plain HTTP to HTTPS.
+server {
+    listen 80;
+    listen [::]:80;
+    server_name vault.example.org;
+    return 301 https://$host$request_uri;
+}