# Timestamp: 2026-10-17 | Version: 6.3.0-dev.1
# Author & Credits: https://www.alawise.es/1-s
# Install as /etc/nginx/conf.d/aux-pxe-tec.conf; replace overlapping old vhosts.
# The certificate must cover all six .es/.eu names before enabling TLS.
# Cache: /var/www/aux.1-s.es/isos; public AUX/PXE: html; public TEC: web.
# Keep private JSON and SMTP credentials outside every public root.

server {
    listen 80;
    listen [::]:80;
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name aux.1-s.es aux.1-s.eu;
    root /mnt/data/bastion-generated-probe;
    index index.php index.html;
    ssl_certificate /etc/letsencrypt/live/ntp1.1-s.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ntp1.1-s.eu/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    access_log /var/log/nginx/aux.access.log;
    error_log /var/log/nginx/aux.error.log warn;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    location / {
        try_files $uri $uri/ =404;
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
    }
    location ~ \.ipxe$ { types { } default_type text/plain; }
    location ~ \.(iso|img|efi|kpxe|lkrn|bin|bzi)$ {
        types { } default_type application/octet-stream;
    }
    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_pass unix:/run/php-fpm/www.sock;
    }
    location ~ /\.(treeinfo|discinfo)$ { try_files $uri =404; }
    location ~ /\. { deny all; access_log off; log_not_found off; }
    location = /assist/index.php { return 308 https://t.1-s.es/index.php$is_args$args; }
    location = /assist/profiles.php { return 308 https://t.1-s.es/profiles.php$is_args$args; }
    location ^~ /assist/ { return 308 https://t.1-s.es/; }
}

server {
    # HTTP remains available for firmware clients; do not redirect PXE to TLS.
    listen 80;
    listen [::]:80;
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name pxe.1-s.es pxe.1-s.eu;
    root /mnt/data/bastion-generated-probe;
    index cli.html;
    ssl_certificate /etc/letsencrypt/live/ntp1.1-s.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ntp1.1-s.eu/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    access_log /var/log/nginx/pxe.access.log;
    error_log /var/log/nginx/pxe.error.log warn;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    location = / { try_files /cli.html =404; }
    location / {
        try_files $uri $uri/ =404;
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
    }
    location ~ \.ipxe$ { types { } default_type text/plain; }
    location ~ \.(iso|img|efi|kpxe|lkrn|bin|bzi)$ {
        types { } default_type application/octet-stream;
    }
    location ~ \.php$ { return 404; }
    location ~ /\.(treeinfo|discinfo)$ { try_files $uri =404; }
    location ~ /\. { deny all; access_log off; log_not_found off; }
}

server {
    listen 80;
    listen [::]:80;
    server_name tec.1-s.es tec.1-s.eu;
    return 308 https://t.1-s.es$request_uri;
}
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name tec.1-s.es tec.1-s.eu;
    root /var/www/aux.1-s.es/web;
    index index.php;
    ssl_certificate /etc/letsencrypt/live/ntp1.1-s.eu/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ntp1.1-s.eu/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    client_max_body_size 16k;
    access_log /var/log/nginx/tec.access.log;
    error_log /var/log/nginx/tec.error.log warn;
    location / { try_files $uri $uri/ =404; }
    location ~ \.php$ {
        try_files $uri =404;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param HTTPS $https if_not_empty;
        fastcgi_pass unix:/run/php-fpm/tec.sock;
    }
    location ~ /\. { deny all; }
}