add nginx config (closes #117)

docs/README.md

@@ -17,3 +17,20 @@ This implementation is compliant with [SSB HTTP Authentication](https://github.c
 A summary can be seen in the following chart:
 
 ![Chart](./login-chart.png)
+
+# HTTP Hosting
+
+We currently assume a standard HTTPS server in front of go-ssb-room to facilitate TLS termination and certificate management. This should be possible with most modern HTTP servers since it's a pretty standard practice, known as [reverse proxying](https://en.wikipedia.org/wiki/Reverse_proxy).
+
+Two bits of rational:
+
+1) People usually want to have more then one site on their server. Put differently we could have LetsEncrypt inside the go-ssb-room server but it would have to listen on port :443, blocking the use of other domains on the same IP.
+2) Listening on :443 can be pretty annoying (you might need root priviliges or similar capabilities).
+
+go-ssb-room needs three headers to function properly, which need to be forwarded by the webserver.
+
+* `X-Forwarded-Host` as which domain name the room is running (enforce strict TLS checking)
+* `X-Forwarded-Proto` to ensure that TLS is used (and redirect if necessary)
+* `X-Forwarded-For` the remote TCP/IP address of the client accessing the room (used for rate limiting)
+
+[nginx-example.conf](./nginx-example.conf) contains an [nginx](https://nginx.org) config that we use for `hermies.club`. To get a wildcard TLS certificate you can follow the steps in [this](https://medium.com/@alitou/getting-a-wildcard-ssl-certificate-using-certbot-and-deploy-on-nginx-15b8ffa34157) article which uses the [certbot](https://certbot.eff.org/) utility.

docs/nginx-example.conf

@@ -0,0 +1,67 @@
+server {
+    server_name hermies.club;
+
+    listen 443 ssl; # managed by Certbot
+
+    ssl_certificate /etc/letsencrypt/live/hermies.club/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/hermies.club/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    location / {
+        proxy_pass http://localhost:8899;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        # for websocket
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+    }
+
+    # TODO: https://blog.tarq.io/nginx-catch-all-error-pages/
+}
+
+# this server uses the (same) wildcard cert as the one above but uses a regular expression on the hostname
+# which extracts the first subdomain which holds the alias and forwards that to the prox_pass server
+server {
+    server_name "~^(?<alias>\w+)\.hermies\.club$";
+
+    listen 443 ssl; # managed by Certbot
+
+    ssl_certificate /etc/letsencrypt/live/hermies.club/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/hermies.club/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+
+    location = / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://localhost:8899/alias/$alias;
+    }
+
+    location / {
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Host $host;
+        proxy_set_header X-Forwarded-For $remote_addr:$remote_port;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_pass http://localhost:8899;
+    }
+
+    # TODO: https://blog.tarq.io/nginx-catch-all-error-pages/
+}
+
+server {
+    if ($host ~ hermies.club$ ) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name hermies.club;
+    return 404; # managed by Certbot
+}