# osint.rpi.local — Sentinel-1 SAR tile proxy (/titiler/)
#
# GitOps: this file is the source of truth. On the Pi:
#   sudo cp deploy/osint-titiler.nginx.conf /etc/nginx/snippets/osint-titiler.conf
# then `include snippets/osint-titiler.conf;` inside the osint.rpi.local server
# block (before `location /`), `nginx -t && systemctl reload nginx`.
#
# The browser hits /titiler/cog/tiles/... (same-origin). We strip the /titiler
# prefix so self-hosted TiTiler (127.0.0.1:8001) sees /cog/tiles/... and proxy
# its response straight back. Tiles are heavy PNGs — disable buffering so a
# slow client doesn't hold a worker open.

location /titiler/ {
    proxy_pass http://127.0.0.1:8001/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffering off;
    proxy_read_timeout 300s;
}