# Monitor (monitor.) — admin-only log stream, basic_auth enforced by caddy.
#
# Rendered into ulicraft-caddy.conf.tmpl at ${MONITOR_SERVER} by render-nginx.sh,
# ONLY when MONITOR_ENABLED=on. With `off` the placeholder collapses to a
# comment, so the name has no TLS vhost at all (and needs no cert — drop
# `monitor` from LE_SUBDOMAINS on that host).
#
# proxy_buffering is left at the default ON: the log API is plain polling, not
# SSE, precisely so this vhost needs no special treatment. If a future phase
# switches to streaming, `proxy_buffering off;` MUST be added here or the stream
# stalls on prod only — see plan/23-monitor.md.
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name monitor.${BASE_DOMAIN};

    ssl_certificate     ${APP_DIR}/certs/monitor.${BASE_DOMAIN}/cert.pem;
    ssl_certificate_key ${APP_DIR}/certs/monitor.${BASE_DOMAIN}/key.pem;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Admin-only surface — keep it out of search engines even though it 401s.
    add_header X-Robots-Tag "noindex, nofollow" always;

    location / {
        proxy_pass http://ulicraft_caddy;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}