# HTTPS Reverse Proxy

This directory hosts the single public HTTPS entry point for apps under `/opt/docker/apps`.

## Route config

Edit [config/proxy.yaml](/opt/docker/apps/proxy/config/proxy.yaml) and add routes like:

```yaml
server_name: mnmsoft.hopto.org
certificate_name: mnmsoft.hopto.org

routes:
  - project_dir: /opt/docker/apps/turnir2024
    path_suffix: odzaci-open-2026
    port: 32834
    upstream_scheme: https
```

Fields:

- `project_dir`: informational only, kept in the generated config and landing page.
- `path_suffix`: public path after the domain. `odzaci-open-2026` becomes `https://mnmsoft.hopto.org/odzaci-open-2026/`.
- `port`: port exposed on the Docker host by the target app.
- `upstream_scheme`: optional, defaults to `http`. Use `https` if the backend app still terminates TLS itself.
- `upstream_host`: optional, defaults to `host.docker.internal`.

## Start

```bash
./scripts/render.sh
docker compose up -d
```

After changing routes:

```bash
./scripts/render.sh
docker compose restart proxy
```

## TLS certificates

Issue a Let's Encrypt certificate after the proxy is reachable on public port `80`:

```bash
./scripts/certbot-init.sh mnmsoft.hopto.org you@example.com
```

Renew manually:

```bash
./scripts/certbot-renew.sh
```

Typical cron entry:

```cron
0 3 * * * cd /opt/docker/apps/proxy && ./scripts/certbot-renew.sh >/var/log/proxy-certbot-renew.log 2>&1
```

The proxy serves certificates from a stable path:

```text
./letsencrypt/live/current/fullchain.pem
./letsencrypt/live/current/privkey.pem
```

Certbot may create versioned lineages such as `mnmsoft.hopto.org-0001`; the helper scripts automatically repoint `live/current/` to the latest real lineage after issuance or renewal.

## Important behavior

This proxy strips the configured prefix before forwarding. Example:

- public request: `/odzaci-open-2026/api/matches`
- upstream request: `/api/matches`

It also sends `X-Forwarded-Prefix: /odzaci-open-2026`.

Apps that generate absolute URLs from `/` instead of respecting the forwarded prefix may still need app-level configuration changes.