# nginx in front of one Littoral process on 127.0.0.1:8080, with TLS.
# Server push (server-sent events) and WebSockets need the settings marked.

map $http_upgrade $connection_upgrade { default upgrade; '' close; }

server {
    listen 80;
    server_name bookshop.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name bookshop.example.org;
    ssl_certificate     /etc/letsencrypt/live/bookshop.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bookshop.example.org/privkey.pem;

    client_max_body_size 10m;              # match *max-request-size*

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        # WebSockets (littoral/websocket):
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        # Server push: don't buffer streams, and let them stay open.
        proxy_buffering off;
        proxy_read_timeout 1h;
    }
}

# Several processes: give each an instance id ((start … :instance-id "a"))
# and route by the session key's prefix, which URL sessions carry in _s:
#
#   map $arg__s $littoral_backend {
#       ~^a\.   127.0.0.1:8081;
#       ~^b\.   127.0.0.1:8082;
#       default 127.0.0.1:8081;
#   }
#   ... proxy_pass http://$littoral_backend;