# Nginx 443 SNI (C3 / C4)

gnet v2 has no native TLS. IM certificates live here, not in spark-server `tcp.tls`.

```text
Client --TLS--> :443 ssl_preread
                  ├─ SNI sparkapi.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
                  │                              → proxy_pass http://127.0.0.1:18080 + X-Real-IP
                  └─ SNI sparkim.wyrs365.com  → 127.0.0.1:19001 (IM TLS)
                                               → PROXY protocol → 127.0.0.1:19000 gnet
```

On this ECS, `:443` is shared with other wyrs HTTPS sites. Do **not** replace `/etc/nginx/nginx.conf`. Drop-ins:

- `host/sparkapi.conf` → `/etc/nginx/conf.d/`
- `host/spark-sni.conf` → `/etc/nginx/stream.d/`

Existing `listen 443 ssl` vhosts move to `127.0.0.1:8443 ssl proxy_protocol` so SNI can take public 443 and `$remote_addr` stays the client IP.

spark-server (Docker):

- HTTP `127.0.0.1:18080` → container `:8080`
- TCP `127.0.0.1:19000` with `proxy_protocol: true` → container `:9000`
- Public security group: 443 only

```bash
bash deploy/nginx/install-host.sh
```

`http.conf` / `stream.conf` / `nginx.conf` are a dedicated-box template. `/readyz` is loopback-only on 8443; local probes hit Gin on `127.0.0.1:18080`.