# Production topology: security.preset "publicRead" equivalent — reading the
# repo (apt clients) needs no credentials, writing (the API under /api/) does.
# Health-check paths stay exempt so container/orchestrator probes never need
# credentials in any mode.
#
# Mounted at /etc/nginx/conf.d/default.conf, which the base image's own
# nginx.conf already `include`s from inside its own http{} block — so this
# file must contain ONLY a server{} block (or other http-context directives),
# never its own http{}/events{}/worker_processes wrapper.
server {
  listen 8080;
  server_name _;
  client_max_body_size 0;
  absolute_redirect off;

  location = /healthz { access_log off; return 200 "ok\n"; }

  location = /api/ready   { access_log off; proxy_pass http://aptly:8080; }
  location = /api/healthy { access_log off; proxy_pass http://aptly:8080; }

  location /api/ {
    auth_basic           "aptly";
    auth_basic_user_file /run/aptly/htpasswd;

    proxy_pass              http://aptly:8080;
    proxy_http_version      1.1;
    proxy_set_header        Host $host;
    proxy_request_buffering off;
    proxy_read_timeout      3600s;
    proxy_send_timeout      3600s;
  }

  location = /signing-key.asc {
    alias /run/aptly/pub/signing-key.asc;
    default_type text/plain;
  }

  location / {
    root /var/lib/aptly/public;
    autoindex on;
    autoindex_exact_size off;

    location ~* /(InRelease|Release|Release\.gpg|Packages(\.[a-z0-9]+)?|Sources(\.[a-z0-9]+)?)$ {
      root /var/lib/aptly/public;
      add_header Cache-Control "no-cache" always;
    }
  }
}