# frp-mtls.conf — nginx :8470 TLS-termination + device-CA mTLS + WS-upgrade proxy to frps vhost.
#
# Native mTLS tunnel · V4. Install target: /etc/nginx/conf.d/frp-mtls.conf
# This is a conf.d snippet (safe to ADD — it only introduces a NEW loopback :8470 server + one map;
# it does NOT touch the existing stream :443 map, which is edited separately per stream-sni-additions.md).
#
# Data-path security gate: `ssl_verify_client on` against the DEVICE CA (with CRL) is the ONE gate for
# the tunnelled base app. `on`, NEVER `optional` (PLAN P-D / R2). The public :8470 SERVER cert is the
# LE wildcard (V3); the CLIENT trust anchor is the private device CA (V2) — two different chains.
#
# nginx 1.24: there is NO standalone `http2` directive here and NO `http2 off;` — HTTP/2 is off by
# default on this listen and `http2 off;` is INVALID on 1.24 (would fail `nginx -t`, PLAN R7).

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 127.0.0.1:8470 ssl;
    server_name ~^.+\.terminal\.yaojia\.wang$;

    ssl_certificate     /etc/relay/frp-tls/fullchain.pem;   # LE wildcard *.terminal.yaojia.wang (V3)
    ssl_certificate_key /etc/relay/frp-tls/privkey.pem;

    # --- the data-path security gate ---
    ssl_verify_client on;                                   # ON, never `optional`
    ssl_client_certificate /etc/relay/device-ca/device-ca.cert.pem;
    ssl_verify_depth 1;
    ssl_crl /etc/relay/device-ca/crl.pem;                   # revocation from day one (V2)

    location / {
        proxy_pass http://127.0.0.1:7080;                   # frps vhost — routes by Host → subdomain
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Origin https://$host;              # needed for Android/curl; harmless for iOS
        proxy_set_header X-Client-Cert-CN $ssl_client_s_dn;
        proxy_buffering off;
        proxy_read_timeout 3600s;                           # prevents idle-WS proxy kill (default 60s, R6)
        proxy_send_timeout 3600s;
    }
}