# Voorbeeld: één NGINX als L7 (HTTP → app :3000) + L4 TCP stream (trackers → telematics-gateway :5027).
# Pas servernamen, certificaten en upstreams aan. Niet copy-paste productie zonder review.

worker_processes auto;
events { worker_connections 4096; }

http {
  # Upstream naar OmniTrack HTTP API + SPA (Docker `app` of VM)
  upstream omnitrack_http {
    server 127.0.0.1:3000;
    # server 10.0.0.2:3000;
  }

  server {
    listen 443 ssl;
    server_name tracking.example.com;

    ssl_certificate     /etc/ssl/certs/your-chain.pem;
    ssl_certificate_key /etc/ssl/private/your-key.pem;

    # TLS settings: gebruik actuele cipher suites en TLS 1.2+ (documentatie NGINX).

    location / {
      proxy_pass http://omnitrack_http;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
  }
}

# TCP load balancing voor Teltonika / binary ingest (sticky op load balancer indien nodig)
stream {
  upstream telematics_tcp {
    server 127.0.0.1:5027;
    # server 10.0.0.3:5027;
  }
  server {
    listen 5027;
    proxy_pass telematics_tcp;
    proxy_timeout 1d;
  }
}
