# farm.sunriselabs.io — TLS front door for farm-ingest.
#
# This file is deliberately HTTP-only. `certbot --nginx -d farm.sunriselabs.io`
# reads it, obtains the certificate, then rewrites this same file in place to add
# the 443 server block and the 80→443 redirect.
#
# Do NOT hand-write the ssl_certificate lines first: nginx refuses to load a config
# pointing at a certificate that does not exist yet, so a reload would take every
# other site on the box down with it. Bootstrap on 80, let certbot do the rest.
#
# The bun service binds 127.0.0.1:8790 and is never exposed directly — the bearer
# token is all that guards it, so it must only ever travel over TLS.

server {
    listen 80;
    listen [::]:80;
    server_name farm.sunriselabs.io;

    # A 50-reading batch is ~8 KB. This is a farm sensor endpoint, not an upload host.
    client_max_body_size 1m;

    location / {
        proxy_pass http://127.0.0.1:8790;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # A phone on marginal 4G can take a while to finish a POST. Be patient rather
        # than 504-ing a batch the phone would only have to send again.
        proxy_read_timeout    60s;
        proxy_connect_timeout 10s;
    }
}