xenia-pos-local/nginx-proxy/nginx.conf

# Xenia POS — on-site proxy config.
# install.sh writes this exact file on client sites; nginx-proxy/nginx.conf in the
# repo is a byte-identical copy. Change both together (global Working Rule 9).
#
#   :80   waiter.* / manager.* hostnames  → redirect to https (legacy domain setup)
#   :80   anything else (bare LAN IP)     → waiter app over plain HTTP, LAN only
#         /manager                        → redirect to :8081
#   :8081                                 → manager dashboard over plain HTTP, LAN only
#   :443  waiter.* / manager.* / bare IP  → https (needs certs/cert.pem + key.pem)
#   :4443                                 → manager over https
#   :8443                                 → native app over TLS (backend-managed key, pinned), LAN only
#
# Every proxied location forwards WebSocket upgrades (/api/ws/connect) and
# disables buffering (SSE), otherwise live events never reach phones / KDS.

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# ── Plain HTTP ────────────────────────────────────────────────────────────────

server {
    listen 80;
    server_name waiter.* manager.*;
    return 301 https://$host$request_uri;
}

server {
    listen 80 default_server;
    server_name _;

    # LAN only: plain HTTP must never be reachable from the internet, even if the
    # client forwards ports on their router. Relies on Docker preserving the real
    # client IP (default iptables port publishing on Linux).
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    allow 127.0.0.0/8;
    allow fc00::/7;
    allow fe80::/10;
    allow ::1;
    deny  all;

    location ~ ^/manager/?$ {
        return 302 http://$host:8081/;
    }

    location / {
        proxy_pass http://waiter_pwa:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }
}

server {
    listen 8081 default_server;
    server_name _;

    # LAN only: plain HTTP must never be reachable from the internet, even if the
    # client forwards ports on their router. Relies on Docker preserving the real
    # client IP (default iptables port publishing on Linux).
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    allow 127.0.0.0/8;
    allow fc00::/7;
    allow fe80::/10;
    allow ::1;
    deny  all;

    location / {
        proxy_pass http://manager_dashboard:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }
}

# ── HTTPS ─────────────────────────────────────────────────────────────────────

server {
    listen 443 ssl;
    server_name waiter.*;

    ssl_certificate     /etc/nginx/certs/cert.pem;
    ssl_certificate_key /etc/nginx/certs/key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://waiter_pwa:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }
}

server {
    listen 443 ssl;
    server_name manager.*;

    ssl_certificate     /etc/nginx/certs/cert.pem;
    ssl_certificate_key /etc/nginx/certs/key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://manager_dashboard:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }
}

server {
    listen 443 ssl default_server;
    server_name _;

    ssl_certificate     /etc/nginx/certs/cert.pem;
    ssl_certificate_key /etc/nginx/certs/key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location /api/ {
        proxy_pass http://backend:8000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }

    location / {
        proxy_pass http://waiter_pwa:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }
}

server {
    listen 8443 ssl default_server;
    server_name _;

    # Encrypted LAN entry for the native app (plan step 7). Key + self-signed cert
    # are created and renewed by the backend (services/tls_identity.py) under
    # ${DATA_PATH}/tls; phones pin the public key, so renewals need no action.
    ssl_certificate     /etc/nginx/xenia-tls/cert.pem;
    ssl_certificate_key /etc/nginx/xenia-tls/key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    # LAN only: plain HTTP must never be reachable from the internet, even if the
    # client forwards ports on their router. Relies on Docker preserving the real
    # client IP (default iptables port publishing on Linux).
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    allow 127.0.0.0/8;
    allow fc00::/7;
    allow fe80::/10;
    allow ::1;
    deny  all;

    location / {
        proxy_pass http://waiter_pwa:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }
}

server {
    listen 4443 ssl default_server;
    server_name _;

    ssl_certificate     /etc/nginx/certs/cert.pem;
    ssl_certificate_key /etc/nginx/certs/key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://manager_dashboard:80;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
    }
}