AMI: route AI Gateway / Hub agent surface / SCIM through nginx

[Nexus-ABC]

Summary

The appliance's nginx-nexus.conf only reverse-proxied the Control Plane (/api, /oauth, /authserver, /.well-known, /healthz). Every other service surface fell through to the SPA try_files, so the AI Gateway was unreachable over 443 even though first-boot advertises publicURL https://<ip>/v1. This wires up the missing surfaces.

Found while debugging a live deployment: GET https://<ip>/v1/models returned the UI's index.html (HTTP 200 text/html), and /healthz returned {"message":"Not Found"} (404).

No new ports and no EC2 Security Group change — everything rides on 443, which is already open.

Changes (nexus-ami/artifacts/configs/nginx-nexus.conf)

• AI Gateway (:3050) — one regex location covering /v1, /v1beta, /openai/deployments, /api/paas (OpenAI / Gemini / Azure / GLM ingress wire formats). Regex so /api/paas wins over the plain /api/ prefix. proxy_buffering off + HTTP/1.1 so SSE streaming relays chunk-by-chunk.
• Nexus Hub (:3060) — /ws (WebSocket upgrade, 1h read timeout) and /api/internal/things/ (agent enrollment + thingclient HTTP fallback) so remote endpoint-agents can enroll/connect over 443. Confirmed no namespace clash: CP's /api/internal only registers /auth/revoke-device. Bearer/device/enrollment-token gated by the Hub. The Hub admin API (/api/hub/*) and /metrics stay loopback-only.
• SCIM — /scim/ → Control Plane for Okta/Entra user provisioning.
• /api/ — added proxy_buffering off so admin SSE (compliance-overview export, AI Gateway Simulator forward) streams.
• /healthz bug fix — was proxy_pass .../api/healthz (CP serves /healthz at root → 404). Now preserves the path. Added /ready.

Verification

• Route surface cross-checked against actual registrations: AI Gateway routes.go (/v1/*, /v1beta, /openai/deployments, /api/paas), Hub routes.go (GET /ws, /api/internal/things/*), CP routes.go (/scim/v2, /healthz, /ready, /api/internal/auth only).
• nginx brace balance verified (18/18); regex-vs-prefix precedence reasoned through for the /api/paas and /api/internal/things/ cases.
• Intentionally NOT exposed: gateway /internal/*, both /metrics, CP /debug/runtime, Hub /api/hub/*.

Security note

/v1/*, /ws, and /api/internal/things/* become internet-reachable. They are not anonymous: /v1/* requires a virtual key; the Hub agent surface is gated by per-device / enrollment / internal-service tokens. Documented in nexus-ami/README.md along with the endpoint map, an OpenAI-verification curl, and the remote-agent enrollment command.

Note: independent of #22 (branched from main); touches different files, no conflict.

🤖 Generated with Claude Code