Metadata-Version: 2.4
Name: splent_feature_nginx
Version: 1.3.0
License-Expression: LGPL-3.0-or-later
Requires-Python: >=3.13
Description-Content-Type: text/markdown
License-File: COPYING
License-File: COPYING.LESSER
Requires-Dist: splent_framework>=1.21.0
Dynamic: license-file

# splent_feature_nginx

Nginx reverse proxy for SPLENT products (config archetype). It ships no Python
behaviour of its own: it brings an nginx container that sits in front of the
product's web service and answers on the product's HTTP and HTTPS ports.

## What it provides

- Docker:
  - `docker/docker-compose.dev.yml`, nginx in front of the development server.
  - `docker/docker-compose.prod.yml`, built from `docker/Dockerfile.prod`, with
    the `certbot_webroot` and `letsencrypt` volumes for TLS certificates.
  Both join `splent_network`, where they reach the product as
  `NGINX_UPSTREAM_HOST:NGINX_UPSTREAM_PORT`.
- Server templates in `docker/nginx/templates/`, one per environment, rendered
  by the nginx image at start.
- `docker/nginx/locations/`, where a product drops extra `location` blocks.
  `protected-files.conf.example` shows how to serve files the app has
  authorised through `X-Accel-Redirect`.
- An entrypoint script, `15-splent-trusted-proxies.sh`, that trusts
  `X-Forwarded-Proto` and `X-Forwarded-Host` only from
  `NGINX_TRUSTED_PROXY_CIDRS`.
- An `nginx` entry in the Administration section of the menu registry, for
  administrators only. It opens the site through the proxy, at
  `NGINX_SERVER_NAME` (its first name that is a host) on
  `NGINX_HTTP_HOST_PORT`, in a new tab. It needs `splent_framework>=1.21.0`.
- For one more minor, the same link in the signed-in sidebar slot
  (`layout.authenticated_sidebar`), at `localhost` as before, for the shells
  that still draw slots instead of the registry.

## Configuration

| Env var | Default | Purpose |
| --- | --- | --- |
| `NGINX_UPSTREAM_HOST` | `__PRODUCT___web` | The product's web container, resolved to the product name by `product:env --merge` and `product:build`. |
| `NGINX_UPSTREAM_PORT` | `5000` | Port the web container listens on. |
| `NGINX_HTTP_HOST_PORT` | `80` | Host port for HTTP. Gets the product's port offset. |
| `NGINX_HTTPS_HOST_PORT` | `443` | Host port for HTTPS. Gets the product's port offset. |
| `NGINX_SERVER_NAME` | `localhost` | `server_name` of the virtual host. |
| `NGINX_TRUSTED_PROXY_CIDRS` | empty | Peers allowed to set the forwarded headers. Empty trusts nobody. Set it only behind a TLS terminator on the host. |

## Use it in a product

```bash
splent feature:add splent_feature_nginx
```
