# Mesh-only vhost for newsfeed, fronted by the oolon edge proxy (kosherinata site).
# Cert: internal `lair` CA, minted by infra-setup.sh and renewed by step@newsfeed.timer
# (see architecture internal-tls.md). Serves the static SPA and reverse-proxies the API
# to the newsfeed-api daemon on slartibartfast over the WireGuard mesh.
#
# Enable with a relative symlink into sites-enabled (reverse-proxies.md §4):
#   ln -sf ../sites-available/newsfeed.internal.conf /etc/nginx/sites-enabled/

upstream newsfeed_api {
    server slartibartfast.kosherinata.internal:22672;
    keepalive 16;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name newsfeed.internal;

    ssl_certificate     /etc/nginx/tls/cert/newsfeed.internal.pem;
    ssl_certificate_key /etc/nginx/tls/key/newsfeed.internal.pem;
    ssl_protocols       TLSv1.3;
    ssl_trusted_certificate /etc/pki/ca-trust/source/anchors/root-internal.pem;

    root /var/www/newsfeed;
    index index.html;

    # API + health probe → newsfeed-api on slartibartfast.
    location /v1/ {
        proxy_pass http://newsfeed_api;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # For future WebSocket streaming endpoints, add the standard Upgrade/Connection
        # map here (define `$connection_upgrade` once in http context).
    }
    location = /health {
        proxy_pass http://newsfeed_api;
    }

    # Static SPA with client-side routing fallback.
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Long-cache the fingerprinted asset bundle.
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }
}