# Reference copy of the device door installed at
# /opt/nginx/conf/sites-available/helpdesk-device.conf (symlinked into sites-enabled).
# TLS but NO client cert: the phone can't hold one. Authentication is the app-level HMAC
# (bearer + signature over ts.nonce.body + nonce replay + clock skew), verified by the backend.
# Strict path allowlist; operator-identity headers are blanked in the proxy snippet.

limit_req_zone $binary_remote_addr zone=helpdesk_device:10m rate=10r/s;

server {
    listen 8443 ssl;
    listen [::]:8443 ssl;
    http2 on;
    server_name moje.al.army;

    ssl_certificate     /etc/ssl/moje.al.army/fullchain.pem;   # same Let's Encrypt cert as the console
    ssl_certificate_key /etc/ssl/moje.al.army/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    access_log /opt/nginx/logs/helpdesk-device.access.log main;
    error_log  /opt/nginx/logs/helpdesk-device.error.log;

    # Allowlist: exactly the paths the phone uses. Everything else 404s at the edge.
    location /api/v1/calls/ {
        limit_req zone=helpdesk_device burst=30 nodelay;
        client_max_body_size 64k;
        include snippets/helpdesk-device-proxy.conf;
    }
    location /api/v1/device/ {
        limit_req zone=helpdesk_device burst=30 nodelay;
        client_max_body_size 64k;
        include snippets/helpdesk-device-proxy.conf;
    }
    location /api/v1/recordings/ {
        limit_req zone=helpdesk_device burst=10 nodelay;
        client_max_body_size 64m;   # a 33 min lossless WAV or ~89 min of AAC; see docs/device-api.md
        include snippets/helpdesk-device-proxy.conf;
    }
    location / { return 404; }
}