# Lab gateway that exposes vCenter default HTTPS (443) and proxies to the
# single FastAPI simulator process.
#
# Upstream listens on an internal-only port (simulator:8080). Host clients
# should hit https://localhost/ — not the internal app port.
#
# Use a variable + Docker DNS resolver so nginx starts even if the simulator
# hostname is not yet resolvable (avoids crash-loop on recreate).

map $server_port $vmware_service {
    default   "simulator";
    80        "http";
    443       "vcenter";
}

server {
    listen 80;
    server_name _;
    resolver 127.0.0.11 valid=10s ipv6=off;

    set $vmware_upstream simulator:8080;

    location / {
        proxy_pass http://$vmware_upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-VMware-Service $vmware_service;
        proxy_set_header X-Request-ID $request_id;
        add_header X-VMware-Service $vmware_service always;
        add_header X-Forwarded-Port $server_port always;
    }
}

server {
    listen 443 ssl;
    server_name _;

    ssl_certificate /etc/nginx/tls/server.crt;
    ssl_certificate_key /etc/nginx/tls/server.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    resolver 127.0.0.11 valid=10s ipv6=off;
    set $vmware_upstream simulator:8080;

    location / {
        proxy_pass http://$vmware_upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Port 443;
        proxy_set_header X-VMware-Service vcenter;
        proxy_set_header X-Request-ID $request_id;
        add_header X-VMware-Service vcenter always;
        add_header X-Forwarded-Port 443 always;
    }
}