# Example reverse-proxy guard for the intranet app.
# Put this in an nginx server block. To keep 172.16.40.90:8010 as the public
# address, move the FastAPI app to 127.0.0.1:8011 and let nginx listen on 8010.
#
# Create the password file:
#   sudo apt-get install apache2-utils
#   sudo htpasswd -c /etc/nginx/.htpasswd-hanmac USERNAME

server {
    listen 8010;
    server_name 172.16.40.90;

    auth_basic "Hanmac Intranet";
    auth_basic_user_file /etc/nginx/.htpasswd-hanmac;

    location / {
        proxy_pass http://127.0.0.1:8011;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}