spark-server/deploy/nginx/README.md

Nginx 443 SNI (C3 / C4)

gnet v2 has no native TLS. IM certificates live here, not in spark-server tcp.tls.

Client --TLS--> :443 ssl_preread
                  ├─ SNI sparkapi.wyrs365.com → 127.0.0.1:8443 (HTTP TLS)
                  │                              → proxy_pass http://127.0.0.1:18080 + X-Real-IP
                  └─ SNI sparkim.wyrs365.com  → 127.0.0.1:19001 (IM TLS)
                                               → PROXY protocol → 127.0.0.1:19000 gnet

On this ECS, :443 is shared with other wyrs HTTPS sites. Do not replace /etc/nginx/nginx.conf. Drop-ins:

• host/sparkapi.conf → /etc/nginx/conf.d/
• host/spark-sni.conf → /etc/nginx/stream.d/

Existing listen 443 ssl vhosts move to 127.0.0.1:8443 ssl proxy_protocol so SNI can take public 443 and $remote_addr stays the client IP.

spark-server (Docker):

• HTTP 127.0.0.1:18080 → container :8080
• TCP 127.0.0.1:19000 with proxy_protocol: true → container :9000
• Public security group: 443 only

bash deploy/nginx/install-host.sh

http.conf / stream.conf / nginx.conf are a dedicated-box template. /readyz is loopback-only on 8443; local probes hit Gin on 127.0.0.1:18080.