Proxy browser APIs through web service

WEB_DEPLOYMENT.md

@@ -12,19 +12,13 @@ working services and redirect HTTP to HTTPS.
 
 ## Traefik
 
-Create three routers for `doctor.ranaze.com`, ordered by priority:
+Create one `websecure` router with a host rule for `doctor.ranaze.com` and route
+it to the Kubernetes nodes on port `30089`, the Web game NodePort. Reuse the existing
+certificate resolver, load-balancing node list, and HTTP-to-HTTPS middleware.
 
-1. `Host(`doctor.ranaze.com`) && PathPrefix(`/api/Auth`)` routes to the same
+The Web container proxies `/api/Auth/*` to `pauth.ranaze.com` and all other
-   backend service used by `pauth.ranaze.com`.
+`/api/*` requests to `s3q.ranaze.com`, so Traefik does not need separate API
-2. `Host(`doctor.ranaze.com`) && PathPrefix(`/api`)` routes to the Kubernetes
+routers or prefix middleware for this hostname.
-   nodes on port `30088`, the Questions API NodePort.
-3. `Host(`doctor.ranaze.com`)` routes to the Kubernetes nodes on port `30089`,
-   the Web game NodePort.
-
-Do not strip any prefixes. Give the auth router the highest priority, the
-general API router the next-highest priority, and the Web router the lowest.
-Reuse the existing HTTPS entrypoint, certificate resolver, load-balancing node
-list, and HTTP-to-HTTPS middleware.
 
 ## Verification
 

web/nginx.conf

@@ -13,6 +13,28 @@ server {
         return 200 "ok\n";
     }
 
+    location ^~ /api/Auth/ {
+        proxy_pass https://pauth.ranaze.com;
+        proxy_ssl_server_name on;
+        proxy_ssl_name pauth.ranaze.com;
+        proxy_set_header Host pauth.ranaze.com;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 30s;
+    }
+
+    location ^~ /api/ {
+        proxy_pass https://s3q.ranaze.com;
+        proxy_ssl_server_name on;
+        proxy_ssl_name s3q.ranaze.com;
+        proxy_set_header Host s3q.ranaze.com;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_connect_timeout 10s;
+        proxy_read_timeout 60s;
+    }
+
     location = /index.html {
         add_header Cache-Control "no-cache, no-store, must-revalidate" always;
         add_header X-Content-Type-Options "nosniff" always;