# FE nginx stream — TCP proxy to BE sshd for RSSH bastion (ra.apps.f0xx.org:443).
# Install on FE (Gentoo); BE runs openssh with Match User ra-* (see sshd_config.d/ra.conf).
#
# *** DO NOT install under BE /etc/nginx/stream.d/ ***
# BE already uses listen 443 ssl in conf.d/apps.conf (http). Stream listen 443 here
# causes: nginx: [emerg] bind() to 0.0.0.0:443 failed (98: Address in use)
#
# Include from nginx.conf:
#   include /etc/nginx/stream.d/rssh-bastion.conf;

upstream rssh_bastion_be {
    server 10.7.16.128:22;  # artc0 / alpine-be — adjust for cluster/lab
}

server {
    listen 443;
    proxy_pass rssh_bastion_be;
    proxy_connect_timeout 30s;
    proxy_timeout 24h;
}