nginx.conf

worker_processes 1;

events {
    worker_connections 1024;
}

http {
    # A plain Upgrade header check: present -> "upgrade" (proxy the
    # WebSocket handshake through as-is); absent -> "close" (a normal HTTP
    # request on the same connection doesn't accidentally get treated as
    # a protocol upgrade).
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ""      close;
    }

    server {
        listen 80;

        # ilo2/webserver.py runs the WebSocket (video/keyboard/mouse/log)
        # and the static HTML page as two separate servers on two
        # different ports (8765 and 8080) -- deliberately simple on the
        # Python side, no HTTP+WebSocket multiplexing to get right there.
        # This is what turns them into one externally-exposed port: /ws
        # goes to the WebSocket port, everything else to the HTTP one.
        # web/index.html's own wsUrl logic already expects exactly this
        # shape (same-origin, path /ws) whenever it's not being loaded
        # directly off port 8080 (i.e. whenever it's behind this proxy).
        location /ws {
            proxy_pass http://ilo2remastered:8765/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            # The video/control channel is a long-lived connection, not a
            # request/response -- nginx's default proxy_read_timeout (60s)
            # would silently kill it the first time nothing crosses the
            # wire for a minute (an idle console with no keystrokes, no
            # screen change), which looks exactly like a random disconnect.
            proxy_read_timeout 3600s;
        }

        location / {
            proxy_pass http://ilo2remastered:8080/;
            proxy_set_header Host $host;
            # Lets _AuthenticatedHandler._is_https() (ilo2/webserver.py)
            # know TLS actually terminated somewhere upstream of it, so the
            # session cookie can be marked Secure -- see the README's
            # reverse-proxy note. Only correct if *this* nginx is itself
            # sitting behind TLS termination (another proxy, or nginx
            # configured with its own cert) -- plain http:// listen 80
            # here, as shipped, is not that; add TLS in front before
            # setting $scheme to anything but "http" for real.
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}