# Nginx TCP stream proxy for SSL termination with PROXY Protocol v2
# Usage: nginx -c /path/to/nginx-stream.conf
#
# This is a Layer 4 (TCP) proxy - no HTTP inspection, just SSL termination.
# More efficient than HTTP proxy when you only need SSL termination.
#
# PROXY Protocol preserves:
#   - Real client IP address (REMOTE_ADDR)
#   - Destination port (for https scheme inference when dst_port=443)
#
# Note: Nginx stream PROXY protocol is v1 (text) by default.
#       For v2 binary format, consider HAProxy or compile nginx with patches.
#
# Backend options:
#   plackup -s Feersum -p 5000 --keepalive --proxy-protocol app.psgi
#
# Or native:
#   $feersum->set_proxy_protocol(1);
#   $feersum->set_keepalive(1);

# Note: 'stream' module must be compiled in (--with-stream --with-stream_ssl_module)
# Check: nginx -V 2>&1 | grep stream

worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /run/nginx.pid;

events {
    worker_connections 4096;
    use epoll;
}

stream {
    # Logging (optional)
    log_format basic '$remote_addr [$time_local] '
                     '$protocol $status $bytes_sent $bytes_received '
                     '$session_time';
    access_log /var/log/nginx/stream.log basic;

    # Upstream Feersum backends
    upstream feersum_tcp {
        server 127.0.0.1:5000;
        # Add more for load balancing:
        # server 127.0.0.1:5001;
        # server 127.0.0.1:5002;
    }

    upstream feersum_unix {
        server unix:/tmp/feersum.sock;
    }

    #=========================================================================
    # SSL termination -> TCP backend with PROXY Protocol
    #=========================================================================
    server {
        listen 443 ssl;
        listen [::]:443 ssl;

        # SSL certificates
        ssl_certificate /etc/ssl/certs/server.crt;
        ssl_certificate_key /etc/ssl/private/server.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 1d;

        # Proxy to Feersum
        proxy_pass feersum_tcp;

        # PROXY Protocol v1 (sends client IP and destination port 443)
        # Feersum will:
        #   - Set REMOTE_ADDR to real client IP
        #   - Set psgi.url_scheme to "https" (inferred from dst_port=443)
        proxy_protocol on;

        # Timeouts
        proxy_connect_timeout 5s;
        proxy_timeout 60s;

        # TCP keepalive to backend
        proxy_socket_keepalive on;
    }

    #=========================================================================
    # SSL termination -> Unix socket backend with PROXY Protocol
    #=========================================================================
    server {
        listen 8443 ssl;

        ssl_certificate /etc/ssl/certs/server.crt;
        ssl_certificate_key /etc/ssl/private/server.key;
        ssl_protocols TLSv1.2 TLSv1.3;

        proxy_pass feersum_unix;

        # PROXY Protocol for Unix socket backend
        proxy_protocol on;

        proxy_connect_timeout 5s;
        proxy_timeout 60s;
        proxy_socket_keepalive on;
    }

    #=========================================================================
    # Plain TCP passthrough (no SSL, for testing)
    #=========================================================================
    server {
        listen 8080;

        proxy_pass feersum_tcp;
        proxy_connect_timeout 5s;
        proxy_timeout 60s;
        proxy_socket_keepalive on;
    }
}
