# The address Avibe sees your proxy connect FROM — the direct peer, not the browser.
# Same-machine nginx → 127.0.0.1. Another host/container → its IP or CIDR. Comma-separate multiple.
VIBE_UI_TRUSTED_PROXY_IPS=127.0.0.1

# The full public origin your proxy serves — with scheme, no path. Comma-separate multiple.
VIBE_UI_TRUSTED_PUBLIC_ORIGINS=https://avibe.example.com

server {
    listen 443 ssl;
    server_name avibe.example.com;

    # ssl_certificate / ssl_certificate_key ...

    location / {
        proxy_pass http://127.0.0.1:5123;   # your Avibe Web UI address

        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Live updates use WebSockets
        proxy_http_version 1.1;
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}