# Per-vhost nginx configuration for app.example.com, included by nginx-proxy.
#
# A container that sets VIRTUAL_HOST gets its vhost generated automatically and
# needs nothing here. This file is for the cases generation cannot express:
# routes to a service that is not the vhost's main container, and access rules.

# Anything not otherwise routed goes to the public site.
location = / {
    return 301 https://app.example.com/tools/;
}

# Internal-only: the metrics stack, reachable from the private network and
# nowhere else. Keep the deny rule directly beneath the allow rule — nginx takes
# the first match, so an allow added below a `deny all` does nothing.
location ^~ /internal/metrics/ {
    allow 10.0.0.0/8;
    deny all;

    proxy_pass http://prometheus:9090/internal/metrics/;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}