# Test topology: everything open (security.preset "open" equivalent) — no
# auth on read OR write. This is what "komplett unabgesichert" looks like.
# Do not reuse this file for docker-compose.yaml (production).
#
# Mounted at /etc/nginx/conf.d/default.conf, which the base image's own
# nginx.conf already `include`s from inside its own http{} block — so this
# file must contain ONLY a server{} block (or other http-context directives),
# never its own http{}/events{}/worker_processes wrapper.
server {
  listen 8080;
  server_name _;
  client_max_body_size 0;
  absolute_redirect off;

  location = /healthz { access_log off; return 200 "ok\n"; }

  location = /api/ready   { access_log off; proxy_pass http://aptly:8080; }
  location = /api/healthy { access_log off; proxy_pass http://aptly:8080; }

  location /api/ {
    proxy_pass              http://aptly:8080;
    proxy_http_version      1.1;
    proxy_set_header        Host $host;
    proxy_request_buffering off;
    proxy_read_timeout      3600s;
    proxy_send_timeout      3600s;
  }

  location = /signing-key.asc {
    alias /run/aptly/pub/signing-key.asc;
    default_type text/plain;
  }

  location / {
    root /var/lib/aptly/public;
    autoindex on;
    autoindex_exact_size off;
  }
}