Add app

serving/http/default.conf

@@ -1,12 +1,15 @@
-# Lab boot HTTP server (nginx). Replaces the stock default.conf so one server on
-# :80 serves BOTH:
+# Lab boot HTTP server (nginx). One server on :80 serves BOTH:
 #   /         -> the OCI release artifacts (UKI fleet-<ver>.efi, etc.), mounted
 #                read-only from the image volume at /usr/share/nginx/html
-#   /kiosk/   -> the diskless kiosk test page (lab content bind-mounted at
-#                /usr/share/nginx/kiosk, deliberately NOT part of the artifact
-#                image, which stays FROM-scratch).
-# A separate kiosk container was considered, but every service here uses host
-# networking, so a second nginx would fight for :80; a single location is cleaner.
+#   /kiosk/   -> reverse-proxied to the kiosk SPA container (serving/kiosk-app),
+#                a Svelte spaceship-terminal app. NOT part of the artifact image
+#                (that stays FROM-scratch); a separate, independently built image.
+#
+# This nginx uses host networking (firmware must fetch the UKI), so it can't join
+# the kiosk container's bridge network by service name. The kiosk container
+# publishes on 127.0.0.1:8088 (compose), which the host-network nginx reaches
+# over loopback. The trailing slash on proxy_pass strips the /kiosk/ prefix, so
+# the SPA (built with base /kiosk/) gets requests at its own root.
 server {
     listen      80 default_server;
     server_name _;
@@ -17,10 +20,14 @@ server {
         autoindex on;
     }
 
-    # Kiosk test page. The diskless kiosk (kiosk_url) points at
-    # http://boot.fleet.lab/kiosk/ — resolved to this host by the stack's dnsmasq.
+    # Kiosk SPA. The diskless kiosk (kiosk_url) points at
+    # http://boot.fleet.lab/kiosk/ — resolved to this host by the stack's dnsmasq
+    # and proxied to the kiosk-app container.
     location /kiosk/ {
-        alias   /usr/share/nginx/kiosk/;
-        index   index.html;
+        proxy_pass         http://127.0.0.1:8088/;
+        proxy_http_version 1.1;
+        proxy_set_header   Host              $host;
+        proxy_set_header   X-Forwarded-For   $remote_addr;
+        proxy_set_header   X-Forwarded-Proto $scheme;
     }
 }