# nginx target sidecar — Bundle 10 of the 2026-05-02 deployment-target audit.
#
# Minimal HTTPS-only config that boots green with a starter cert from the
# shared target-tls-init container. The k6 connector-tier scenarios connect
# at sustained 100 conns/min and measure handshake-completion latency.
# Production NGINX configs are far richer; this is a load-test fixture, not
# a deployment template.

worker_processes 1;
events {
    worker_connections 1024;
}

http {
    # Quiet log so the loadtest run doesn't fill the docker-compose log.
    access_log off;
    error_log /var/log/nginx/error.log warn;

    server {
        listen 443 ssl;
        server_name _;

        # Bundle 10: starter cert+key written by target-tls-init into the
        # shared volume. Not the deployed cert; this is what makes the
        # daemon boot green so the loadtest scenarios have something to
        # handshake against.
        ssl_certificate     /etc/nginx/certs/target.crt;
        ssl_certificate_key /etc/nginx/certs/target.key;
        ssl_protocols TLSv1.2 TLSv1.3;

        location / {
            return 200 "ok\n";
            add_header Content-Type text/plain;
        }
    }
}