linked device, device tasks and certs in database

nginx/dev.conf

@@ -98,25 +98,25 @@ server {
   }
 
   # ---- mTLS-protected paths ----
-  location ^~ /records {
+  location ^~ /api/records {
     if ($ssl_client_verify != SUCCESS) { 
       return 495; 
     }
-    proxy_pass http://snoop-api:8080;
+    proxy_pass http://snoop-api:8080/;
   }
 
-  location ^~ /tasks {
+  location ^~ /api/tasks {
     if ($ssl_client_verify != SUCCESS) { 
       return 495; 
     }
-    proxy_pass http://snoop-api:8080;
+    proxy_pass http://snoop-api:8080/;
   }
 
-  location ^~ /renew {
+  location ^~ /api/renew {
     if ($ssl_client_verify != SUCCESS) { 
       return 495; 
     }
-    proxy_pass http://snoop-api:8080;
+    proxy_pass http://snoop-api:8080/;
   }
 
   # MediaMTX HLS
@@ -158,4 +158,19 @@ server {
     proxy_set_header Connection $connection_upgrade;
   }
 
+  location ^~ /api/ {
+    proxy_pass http://snoop-api:8080/;   # trailing slash strips /api
+    proxy_http_version 1.1;
+    proxy_set_header Host              $host;
+    proxy_set_header X-Real-IP         $remote_addr;
+    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # (Optional) WS/SSE friendly defaults
+    proxy_set_header Upgrade    $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+    proxy_read_timeout 3600s;
+    proxy_send_timeout 3600s;
+  }
+
 }