server {
    listen 8443 ssl default_server;
    server_name _;

    ssl_certificate     /etc/nginx/certs/repo-server.crt.pem;
    ssl_certificate_key /etc/nginx/certs/repo-server.key.pem;

    root /srv;
    autoindex off;

    # config.json bakes in a __BASE_URL__ placeholder for its "dl"/"api"
    # templates, since the host:port this fixture is actually reached on is
    # only known once tox-docker starts the container, not at image-build
    # time. $http_host reflects exactly what the client (cargo) used to
    # connect, e.g. host.docker.internal:55123; $scheme likewise reflects
    # whichever of this file's two listeners actually served the request.
    location = /config.json {
        default_type application/json;
        sub_filter '__BASE_URL__' '$scheme://$http_host';
        sub_filter_once off;
        sub_filter_types application/json;
    }
}

# Plain-HTTP listener, for the module-rust-http tox env that verifies
# id-configurator correctly configures a non-HTTPS repository.
server {
    listen 8080 default_server;
    server_name _;

    root /srv;
    autoindex off;

    location = /config.json {
        default_type application/json;
        sub_filter '__BASE_URL__' '$scheme://$http_host';
        sub_filter_once off;
        sub_filter_types application/json;
    }
}