# Lab boot HTTP server (nginx). One server on :80 serves BOTH:
#   /         -> the OCI release artifacts (UKI fleet-<ver>.efi, etc.), mounted
#                read-only from the image volume at /usr/share/nginx/html
#   /kiosk/   -> reverse-proxied to the kiosk SPA container (serving/kiosk-app),
#                a Svelte spaceship-terminal app. NOT part of the artifact image
#                (that stays FROM-scratch); a separate, independently built image.
#
# This nginx uses host networking (firmware must fetch the UKI), so it can't join
# the kiosk container's bridge network by service name. The kiosk container
# publishes on 127.0.0.1:8088 (compose), which the host-network nginx reaches
# over loopback. The trailing slash on proxy_pass strips the /kiosk/ prefix, so
# the SPA (built with base /kiosk/) gets requests at its own root.
server {
    listen      80 default_server;
    server_name _;

    # UKI + release artifacts (firmware fetches /fleet-<ver>.efi from here).
    location / {
        root      /usr/share/nginx/html;
        autoindex on;
    }

    # TPM enrolment broker (docs/tpm-enrolment-design.md) — the ONE unauthenticated,
    # pre-auth endpoint. An empty-NV host POSTs its CSR and polls for the signed
    # cert; the admin approve/deny plane is a SEPARATE mTLS listener and is NOT
    # exposed here. Proxied to the broker (dot1x-bench stack) on loopback; the
    # trailing slash strips /enrol/ so the broker sees /request and /status/{id}.
    location /enrol/ {
        proxy_pass           http://127.0.0.1:9090/;
        proxy_http_version   1.1;
        proxy_set_header     Host            $host;
        proxy_set_header     X-Forwarded-For $remote_addr;
        proxy_set_header     Connection "";
        client_max_body_size 16k;     # a CSR is ~1KB — cap abuse
        proxy_read_timeout   30s;
    }

    # Kiosk SPA. The diskless kiosk (kiosk_url) points at
    # http://boot.fleet.lab/kiosk/ — resolved to this host by the stack's dnsmasq
    # and proxied to the kiosk-app container.
    location /kiosk/ {
        proxy_pass         http://127.0.0.1:8088/;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Forwarded-For   $remote_addr;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";   # SSE is plain HTTP — no WebSocket upgrade needed
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 1h;
        chunked_transfer_encoding off;
    }
}