# Example nginx reverse proxy in front of Anwesen.
#
# Anwesen binds 127.0.0.1:8080 and ships no authentication: if a request
# reaches it, it may read everything indexed (ADR-007). This proxy is the
# access boundary -- it terminates TLS, routes by host, and authenticates the
# client before anything reaches the daemon.
#
# Drop into /etc/nginx/sites-available/ (or conf.d/) and adjust the marked
# values: server_name, certificate paths, and the auth block.

upstream anwesen {
    server 127.0.0.1:8080;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;

    # --- Host-based routing: only this name reaches Anwesen ---
    server_name vault.example.org;

    # --- TLS termination ---
    ssl_certificate     /etc/ssl/anwesen/fullchain.pem;
    ssl_certificate_key /etc/ssl/anwesen/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    # --- Client authentication ---
    # Pick one. HTTP basic auth is the simplest:
    auth_basic           "Anwesen";
    auth_basic_user_file /etc/nginx/anwesen.htpasswd;   # htpasswd -c ... anwesen
    #
    # For mutual TLS instead, drop the two auth_basic lines and use:
    #   ssl_client_certificate /etc/ssl/anwesen/clients-ca.pem;
    #   ssl_verify_client on;

    location / {
        proxy_pass http://anwesen;
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Anwesen serves strong ETags and honors If-None-Match; nginx forwards
        # both unchanged, so conditional requests keep working through the proxy.
    }
}

# Redirect plain HTTP to HTTPS.
server {
    listen 80;
    listen [::]:80;
    server_name vault.example.org;
    return 301 https://$host$request_uri;
}