From 5cec2993d7e5055ab04e31712c346c4e19e731a1 Mon Sep 17 00:00:00 2001
From: Oier Bravo Urtasun <oierbravo@gmail.com>
Date: Mon, 8 Jun 2026 01:08:43 +0200
Subject: [PATCH] feat(nginx): serve launcher downloads from apex vhost
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port the /launcher/* static route from caddy's 10-static.caddy to the
nginx apex server (alias -> ./mirror/launcher, autoindex). /ca.crt is
omitted — LE certs are publicly trusted, no guest CA import needed.
The 20-mirror.caddy upstream spoofs stay caddy/air-gap-only.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 nginx/ulicraft.conf.tmpl | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/nginx/ulicraft.conf.tmpl b/nginx/ulicraft.conf.tmpl
index ef87894..b21de2d 100644
--- a/nginx/ulicraft.conf.tmpl
+++ b/nginx/ulicraft.conf.tmpl
@@ -24,7 +24,9 @@ server {
     return 301 https://$host$request_uri;
 }
 
-# Apex — static landing page.
+# Apex — static landing page (./www) + launcher downloads (./mirror/launcher).
+# /ca.crt from the caddy path is intentionally omitted: LE certs are publicly
+# trusted, so guests need no CA import.
 server {
     listen 443 ssl;
     listen [::]:443 ssl;
@@ -34,9 +36,17 @@ server {
     ssl_certificate     ${APP_DIR}/certs/${BASE_DOMAIN}/cert.pem;
     ssl_certificate_key ${APP_DIR}/certs/${BASE_DOMAIN}/key.pem;
 
-    root ${APP_DIR}/www;
-    index index.html;
-    location / { try_files $uri $uri/ =404; }
+    # Launcher downloads (populated by tooling/fetch-launcher.sh -> ./mirror/launcher).
+    location /launcher/ {
+        alias ${APP_DIR}/mirror/launcher/;
+        autoindex on;
+    }
+
+    location / {
+        root ${APP_DIR}/www;
+        index index.html;
+        try_files $uri $uri/ =404;
+    }
 }
 
 # Pack — packwiz metadata (./pack) + custom jars (./custom at /custom/).