# Installed at /opt/nginx/conf/snippets/helpdesk-device-proxy.conf.
# Shared by the device-door locations. The two blanked headers are the security boundary:
# the 443 console proxy injects them AFTER verifying an operator's client cert; a certless
# caller on 8443 must never be able to supply them.
proxy_pass         http://127.0.0.1:4000;
proxy_http_version 1.1;
proxy_set_header   Host              $host;
proxy_set_header   X-Real-IP         $remote_addr;
proxy_set_header   X-Forwarded-Proto $scheme;
proxy_set_header   X-Operator-Cert   "";
proxy_set_header   X-Proxy-Secret    "";
proxy_read_timeout 75s;   # covers the phone's command long-poll