# youtube-automate admin UI — tube.jihakuz.xyz
#
# NOTE: on susan this file is NOT the vhost in use. tube.jihakuz.xyz was already
# served by a leftover TubeArchivist server block inside
# sites-available/jihakuz.xyz (proxying to the now-dead 127.0.0.1:8003), and
# nginx uses the first server block matching a name. That block also already
# owns the Let's Encrypt certificate, so the fix was to repoint it — see
# deploy/fix-nginx-tube.sh. This file is kept as the reference config for a
# clean install on a host without that history.
#
# Install this as /etc/nginx/sites-available/tube.jihakuz.xyz and symlink it into
# sites-enabled, then run:
#
#     sudo certbot --nginx -d tube.jihakuz.xyz
#
# certbot rewrites this file to add the TLS server block and the 80->443
# redirect, matching how the other vhosts on susan are set up.
#
# The DNS record and njal.la update key for tube.jihakuz.xyz already exist in
# ~/.local/bin/update-dns.sh, so no DNS work is needed.

server {
    listen 80;
    listen [::]:80;
    server_name tube.jihakuz.xyz;

    # Small admin forms only; nothing here accepts uploads.
    client_max_body_size 256k;

    # Belt and braces — the app sets these too, but a misconfigured upstream
    # should not be able to drop them.
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;
    add_header Referrer-Policy same-origin always;

    location / {
        proxy_pass http://127.0.0.1:8085;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        # The app throttles failed logins per client address and reads it from
        # this header, so it must be set correctly.
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 120s;
    }
}