# Verbatim /etc/nginx/stream.d/stream.conf from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
map $ssl_preread_server_name $targetBackend {
  default                                 127.0.0.1:4443;
  homepage.reeseapps.com                  reeseapps-homepage.reeselink.com:443;
  ntfy.reeseapps.com                      reeseapps-ntfy.reeselink.com:443;
  gitea.reeseapps.com                     reeseapps-gitea.reeselink.com:443;
  aipi.reeseapps.com                      reeseapps-litellm.reeselink.com:443;
  chatreesept.reeseapps.com               reeseapps-openwebui.reeselink.com:443;
  keycloak.reeseapps.com                  reeseapps-keycloak.reeselink.com:443;
  forgejo.reeseapps.com                   reeseapps-forgejo.reeselink.com:443;
  brain.reeseapps.com                     reeseapps-brain-of-reese.reeselink.com:443;
  brain-of-code.reeseapps.com             reeseapps-brain-of-code.reeselink.com:443;
  immich.reeseapps.com                    reeseapps-immich.reeselink.com:443;
  whiteboard.reeseapps.com                reeseapps-whiteboard.reeselink.com:443;

  stackexpected.com                       stackexpected.reeselink.com:443;
  gitea.stackexpected.com                 stackexpected-gitea.reeselink.com:443;
  keycloak.stackexpected.com              stackexpected-keycloak.reeselink.com:443;
  nextcloud.stackexpected.com             stackexpected-nextcloud.reeselink.com:443;
  hedgedoc.stackexpected.com              stackexpected-hedgedoc.reeselink.com:443;
  wellsfamilycounseling.reeseapps.com     wfc.reeselink.com:443;
}

server {
  listen 443;
  listen [::]:443;
      
  proxy_connect_timeout 1800s;
  proxy_timeout 1800s;
  proxy_protocol on;
  
  proxy_pass $targetBackend;
  ssl_preread on;

  resolver 10.1.0.1;
}