# prometheus.x — the standalone service, served by this VPS.
#
# BCNR serves this name via its `ip`+`tls` records: Theseus and Ariadne
# resolve prometheus.x by fetching the on-chain record, which says
# "connect to <this IP>, pin the TLS cert whose DER sha256 equals <this
# fingerprint>". The resolver reverse-proxies to this vhost; a browser
# with Ariadne's Thread installed does the same.
#
# The cert is self-signed and pinned on chain — no CA is involved and
# none needs to be, which is a narrower claim than a CA makes and does
# not expire on anyone else's schedule. Rotating is one record update.
#
# To regenerate the cert and read out its DER sha256:
#   bash /opt/prometheus/deploy/make-tls-cert.sh
#
# The vhost listens only on HTTPS; the on-chain `tls` pin means plain
# HTTP would be refused by the resolver anyway, and we do not want a
# scanner to be able to read ANYTHING here over cleartext.

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name prometheus.x;

    ssl_certificate     /etc/ssl/prometheus-x/fullchain.pem;
    ssl_certificate_key /etc/ssl/prometheus-x/privkey.pem;

    # The TLS resolver reaches us over the raw IP but passes `prometheus.x`
    # as the Host header. The service's canonical URL generator looks at
    # that header; preserving it keeps rel=canonical honest.
    location / {
        proxy_pass http://127.0.0.1:3700;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        # 200 MiB fits Android APKs and most desktop installers; matches the
        # service's own cap in uploads.js. Publishers of larger binaries
        # self-host and submit a manifest with the external URL + SHA.
        client_max_body_size 200m;
        proxy_request_buffering off;

        proxy_buffering off;
        proxy_read_timeout 120s;
    }
}