# Local proxy of the contest firewall (separate from the nginx of the image).
# The firewall redirects every outgoing connection on port 443 to this proxy,
# which reads the site name sent by the browser (TLS SNI), refuses names that
# are not in allowed_domains.txt and connects to the allowed sites itself.
# The proxy resolves the names on its own, so a program that forces the
# address of an allowed site for another name gets nowhere. Port 80 only
# answers with a redirect to HTTPS.

load_module /usr/lib/nginx/modules/ngx_stream_module.so;

user contest-proxy;
pid /run/contest-proxy.pid;
worker_processes 2;
worker_rlimit_nofile 8192;
error_log stderr warn;

events {
    worker_connections 2048;
}

stream {
    # resolver line (the local DNS filter), written by /firewall.sh
    include /run/contest-firewall/proxy_resolver.conf;

    map $ssl_preread_server_name $upstream {
        hostnames;
        # one "<name> <name>:443;" line per allowed domain, written by /firewall.sh
        include /run/contest-firewall/proxy_names.conf;
        default "";
    }

    log_format sni '$remote_addr "$ssl_preread_server_name" $status $upstream_addr';
    access_log syslog:server=unix:/dev/log,tag=contest_proxy,nohostname sni;

    server {
        listen 127.0.0.1:8443;
        ssl_preread on;
        preread_timeout 10s;
        proxy_connect_timeout 10s;
        proxy_pass $upstream;
    }
}

http {
    access_log off;
    server {
        listen 127.0.0.1:8080;
        return 301 https://$host$request_uri;
    }
}