# Verbatim /etc/nginx/nginx.conf from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /run/nginx.pid;


events {
    worker_connections  1024;
}

stream {  
    include /etc/nginx/stream.d/*.conf;
}

http {
    real_ip_header proxy_protocol;
    set_real_ip_from 127.0.0.1;
    set_real_ip_from 10.0.0.0/8;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format detailed '$remote_addr:$remote_port [$time_local] "$server_name" "$request" '
                        '$status "$body_bytes_sent" "$http_referer" "$http_user_agent" '
                        '$request_time "$upstream_addr" "$upstream_response_time" '
                        '$ssl_protocol/$ssl_cipher';

    access_log  /var/log/nginx/access.log  detailed;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;

    keepalive_timeout  65;

    gzip  on;

    server_tokens off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }
    server {
        listen 80;
        listen [::]:80;
        server_name _;
        return 301 https://$host$request_uri;
    }

    include /etc/nginx/conf.d/*.conf;
}