v0.12.2 drop version from api path, deploy script update

deploy/freebsd/nginx-chess.conf

@@ -1,19 +1,52 @@
-# Host nginx: proxy /chess/ to the chess API in the jail. Include inside the
-# existing TLS server block, next to the security headers. Replace
-# JAIL_IP:API_PORT with the values given to setup-jail.sh.
+# Host nginx for chess: browsers (web and WASM clients) call
+# <origin>/chess/api/... and <origin>/chess/health, which map to the server's
+# /api/... and /health. Replace <jail-address> and <port> (chessd_port,
+# default 8080).
 #
-# chess-server trusts X-Real-IP only from the address in -trusted-proxies
-# (TRUSTED_PROXIES in setup-jail.sh): the address this nginx uses to reach
-# the jail. Do not forward X-Forwarded-For for rate limiting; its first entry
-# is supplied by the client.
-location /chess/ {
-    proxy_pass http://JAIL_IP:API_PORT/;
+# chess-server keys rate limits on X-Real-IP, trusted only from the addresses
+# in chessd_trusted_proxies: the address this nginx uses to reach the jail.
+# $remote_addr must be the real client: with PROXY protocol in front of nginx,
+# set real_ip_header proxy_protocol and set_real_ip_from for that hop.
+
+# --- http {} context ---
+upstream chess_api {
+    server <jail-address>:<port>;
+    keepalive 16;
+}
+
+# --- TLS server {} context ---
+location /chess/api/ {
+    proxy_pass http://chess_api/api/;
+    proxy_http_version 1.1;
+    # Empty Connection header lets nginx reuse upstream keepalive connections.
+    proxy_set_header Connection "";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto https;
+
+    # Long-polling holds a request up to 30 seconds.
+    proxy_buffering off;
+    proxy_read_timeout 60s;
+    proxy_send_timeout 60s;
+
+    # API payloads are small JSON documents.
+    client_max_body_size 16k;
+}
+
+location = /chess/health {
+    proxy_pass http://chess_api/health;
     proxy_http_version 1.1;
     proxy_set_header Connection "";
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
-    # Long-polling waits up to 30 seconds for a game update.
-    proxy_read_timeout 45s;
-    # Bound request bodies; API payloads are small JSON documents.
-    client_max_body_size 16k;
+    proxy_read_timeout 10s;
+}
+
+# Everything else under /chess is not served by the API.
+location = /chess {
+    return 404;
+}
+location /chess/ {
+    return 404;
 }