# Legacy-TLS CalDAV bridge for Android 2.3 phones.
#
# The phone speaks TLS 1.0 with old ciphers and has no modern root CAs. This server accepts
# exactly that, with a self-signed certificate the app pins by SHA-256 fingerprint, and
# forwards ONLY the CalDAV endpoints to Nextcloud. The Nextcloud web UI stays unreachable here.
#
# Edit the lines marked EDIT, then see README.md.

upstream nextcloud {
    # EDIT: where Nextcloud listens, as seen from this container.
    #   Nextcloud serves plain HTTP internally (official docker image :80, AIO :11000): keep :80.
    #   Nextcloud forces HTTPS (port 80 redirects to https://, often alongside HSTS): use its
    #   HTTPS port, e.g. nextcloud:443, AND switch proxy_pass below to https://.
    server nextcloud:80;
}

server {
    # Pangolin raw TCP resource -> this port. Add "proxy_protocol" here only if you also tick
    # "Enable Proxy Protocol" on the Pangolin resource (see README).
    listen 8443 ssl;
    server_name _;

    # EDIT: Nextcloud's own host name, as listed in its trusted_domains.
    set $nc_host cloud.example.com;

    ssl_certificate     /etc/nginx/certs/bridge.crt;
    ssl_certificate_key /etc/nginx/certs/bridge.key;

    # Android 2.3: TLS 1.0, AES-CBC-SHA. SECLEVEL=0 lets OpenSSL 3 negotiate it at all.
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:@SECLEVEL=0";
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:legacy:1m;
    ssl_session_timeout 1h;

    # Relative Location headers: correct even when Pangolin's public port differs from 8443.
    absolute_redirect off;

    client_max_body_size 5m;
    access_log /var/log/nginx/caldav-bridge.log;

    # HSTS from Nextcloud (or added by your proxy) is meant for its real https site. Passed on
    # here it would tell browsers to treat this self-signed endpoint as strict HTTPS, with no
    # way to click through. The phone app ignores HSTS either way.
    proxy_hide_header Strict-Transport-Security;

    location /remote.php/dav/ {
        proxy_pass http://nextcloud;
        # EDIT if Nextcloud forces HTTPS: replace the line above with
        #   proxy_pass https://nextcloud;
        # The phone side stays TLS 1.0; this bridge-to-Nextcloud leg then uses modern TLS.
        proxy_ssl_server_name on;
        proxy_ssl_name $nc_host;
        # Internal hop to your own server, often with a self-signed or LAN-only certificate.
        proxy_ssl_verify off;

        proxy_set_header Host $nc_host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 120s;
        proxy_buffering off;
        # Nextcloud builds absolute URLs from its public address (overwrite.cli.url /
        # overwriteprotocol). Keep the phone on the bridge by reducing them to the path.
        proxy_redirect ~^https?://[^/]+(/.*)$ $1;
    }

    location = /.well-known/caldav {
        return 301 /remote.php/dav/;
    }

    location / {
        return 404;
    }
}