server {
    # Host-networked: listen on the app's own port directly (NOT 80, which the
    # host's main nginx already owns). The app is reached at http(s)://<node>:18083.
    # Loopback ONLY. This container is host-networked, so this nginx binds the
    # HOST's address directly — `listen 18083;` meant every interface, and the
    # app gate could never stand in front of it (there is no podman publish to
    # pin, and the manifest declared no port, so the gate neither protected it
    # nor reported it — it served this page to anyone who asked, on LAN,
    # Tailscale and the mesh alike). Binding loopback lets the daemon claim the
    # external addresses and authenticate them; see appgate::listener.
    listen 127.0.0.1:18083;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Proxy the archipelago backend same-origin so the browser never makes a
    # cross-origin request (no CORS, no host-nginx route dependency). The app is
    # served on this node's :18083; cookies are scoped by host (not port), so the
    # browser already carries the `session` (HttpOnly) and `csrf_token` cookies
    # set by the main UI. We forward both, plus the X-CSRF-Token header, to the
    # backend on 127.0.0.1:5678 (reachable because this container is host-networked).
    #
    # This mirrors fips-ui / electrs-ui. The old bridge + 18083→80 mapping forced
    # cross-origin fetches that broke on http-only nodes (blank fields, QR
    # "failed to fetch").
    location = /lnd-connect-info {
        proxy_pass http://127.0.0.1:5678/lnd-connect-info;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Cookie $http_cookie;
        proxy_set_header X-CSRF-Token $http_x_csrf_token;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 10s;
        proxy_read_timeout 60s;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    location /proxy/lnd/ {
        proxy_pass http://127.0.0.1:5678/proxy/lnd/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Cookie $http_cookie;
        proxy_set_header X-CSRF-Token $http_x_csrf_token;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 10s;
        proxy_read_timeout 60s;
        add_header Cache-Control "no-store";
    }

    location /api/container/logs {
        proxy_pass http://127.0.0.1:5678/api/container/logs;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Cookie $http_cookie;
        proxy_set_header X-CSRF-Token $http_x_csrf_token;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 10s;
        proxy_read_timeout 30s;
        add_header Cache-Control "no-store";
    }

    location / {
        add_header Cache-Control "no-cache";
        try_files $uri $uri/ /index.html;
    }
}