# Replacement for Nginx Proxy Manager's built-in /etc/nginx/conf.d/default.conf.
#
# Only needed to reach mc-webui by bare IP address over HTTPS — see the
# "Browsing by IP address" section of docs/https-setup.md. Not used unless you
# mount it yourself; the stock file is fine for every hostname-based setup.
#
# Why: browsers do not send SNI when you type an IP address, so nginx falls back
# to the default server for port 443. Since 2.15 that default is a block ending in
# `ssl_reject_handshake on;`, which refuses the connection outright. This copy of
# the file keeps the port 80 fallback and drops that 443 block, so the first (or
# only) proxy host becomes the default and answers with its own certificate —
# the behaviour older releases had.
#
# Mount it WITHOUT :ro — the container chowns its config at startup, and on a read-only
# mount that failure aborts s6 init, leaving nginx not listening at all.
#
# This shadows a file that ships inside the image. If a future Nginx Proxy Manager
# release changes it, this copy keeps winning: unmount it to go back to stock.

# "You are not configured" page, which is the default if another default doesn't exist
server {
	listen 80;
	#listen [::]:80;

	set $forward_scheme "http";
	set $server "127.0.0.1";
	set $port "80";

	server_name localhost-nginx-proxy-manager;
	access_log /data/logs/fallback_http_access.log standard;
	error_log /data/logs/fallback_http_error.log warn;
	include conf.d/include/assets.conf;
	include conf.d/include/block-exploits.conf;
	include conf.d/include/letsencrypt-acme-challenge.conf;

	location / {
		index index.html;
		root /var/www/html;
	}
}