# Basic-auth proxy in front of Kong Manager + Admin API.
# OSS Kong has no login (RBAC = Enterprise); this provides one at the edge.
# Credentials: docker/kong/htpasswd (htpasswd/apr1 format).
#   change password:  openssl passwd -apr1 'NewPass' -> replace hash in htpasswd,
#   then: docker compose restart kong-auth

server {
    listen 8002;
    auth_basic "Kong Manager";
    auth_basic_user_file /etc/nginx/htpasswd;

    # Admin API, same-origin under /api/ so the Manager UI's browser calls
    # carry the same basic-auth session (KONG_ADMIN_GUI_API_URL points here).
    location /api/ {
        proxy_pass http://kong:8001/;
        proxy_set_header Host $host;
    }

    # Kong Manager UI
    location / {
        proxy_pass http://kong:8002;
        proxy_set_header Host $host;
    }
}

# Raw Admin API for scripts/curl — same credentials required.
server {
    listen 8001;
    auth_basic "Kong Admin API";
    auth_basic_user_file /etc/nginx/htpasswd;
    location / {
        proxy_pass http://kong:8001;
        proxy_set_header Host $host;
    }
}