# nginx site config for dolt.sr.ht, in the sr.ht-nginx style. Drop into the
# nginx sites dir alongside the other *.sr.ht.conf files; TLS/http2 and the
# shared proxy headers come from the included snippets (sourcehut.conf,
# port443.conf, port80.conf).
#
# Three back-end listeners are multiplexed by path:
#   - the remotesapi gRPC ChunkStoreService and its sealed-URL chunk data plane
#     -> 127.0.0.1:5306
#   - the CredentialsService (dolt login / keypair WhoAmI) -> 127.0.0.1:5308
#   - everything else (web UI + /static) -> 127.0.0.1:5307

server {
	include sourcehut.conf;
	include port80.conf;
	server_name dolt.srht.bigb.es;
}

server {
	include sourcehut.conf;
	include port443.conf;
	server_name dolt.srht.bigb.es;

	# dolt push can stream arbitrarily large table files.
	client_max_body_size 0;

	# remotesapi control plane: gRPC ChunkStoreService (clone/pull/push RPCs).
	# X-Forwarded-Proto must be set so the server hands back https:// sealed
	# chunk URLs (getScheme honors this header).
	location /dolt.services.remotesapi.v1alpha1.ChunkStoreService/ {
		grpc_pass grpc://127.0.0.1:5306;
		grpc_set_header X-Forwarded-Proto https;
		grpc_read_timeout 600s;
		grpc_send_timeout 600s;
		client_max_body_size 0;
	}

	# CredentialsService.WhoAmI: the `dolt login` keypair association flow.
	location /dolt.services.remotesapi.v1alpha1.CredentialsService/ {
		grpc_pass grpc://127.0.0.1:5308;
		grpc_set_header X-Forwarded-Proto https;
	}

	# Chunk data plane: AES-GCM sealed URLs (possession == authorization),
	# 15-minute expiry. GET on pull, PUT on push. No extra auth needed.
	location /single_symmetric_key_sealed_request/ {
		proxy_pass http://127.0.0.1:5306;
		client_max_body_size 0;
		proxy_request_buffering off;
		proxy_read_timeout 600s;
		proxy_send_timeout 600s;
	}

	# Web UI and /static.
	location / {
		proxy_pass http://127.0.0.1:5307;
		include headers.conf;
		include web.conf;
	}

	location /static {
		root /usr/share/sourcehut;
		expires 30d;
	}
}