# SiMS HQ console — host nginx vhost. Same name as its home in nginx
# (/etc/nginx/conf.d/sims.hq.conf), so it's one name end to end. Install as:
#   sudo cp deploy/sims.hq.conf /etc/nginx/conf.d/sims.hq.conf
#   sudo nginx -t && sudo systemctl reload nginx
# Reuses the *.simssoftware.in wildcard cert; proxies to the HQ container on 127.0.0.1:5182.
# The public /share/:token links go through here too (token-guarded, rate-limited, revocable).
server {
    listen 80;
    server_name hq.simssoftware.in;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl;
    server_name hq.simssoftware.in;

    ssl_certificate     /etc/ssl/sims/sims.crt;
    ssl_certificate_key /etc/ssl/sims/sims.key;
    ssl_prefer_server_ciphers on;

    # APEX CSV import + PDF uploads exceed nginx's 1 MB default, which would 413.
    client_max_body_size 1000M;

    location / {
        proxy_pass http://127.0.0.1:5182;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        # REPLACE, do not append (D24 red-team). With the app's `trust proxy 1`, Express
        # reads the last X-Forwarded-For hop as the client IP. $proxy_add_x_forwarded_for
        # would append to a CLIENT-SUPPLIED header, letting a caller inject a fake IP and
        # bypass the per-IP login/reveal rate limiters. $remote_addr is the real socket
        # peer and cannot be forged, so the app always keys limits on the true client.
        proxy_set_header X-Forwarded-For   $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}