Feature/nginx js

[unilynx]

a series of nginxjs features. does not activate yet, that requires starting WebHare as specified in the docs

[webharebot]

🤖 Auto-Approved: PR author (@unilynx) is an internal organization/repository member.

[unilynx]

Should target post 6.1

[blexrob]

DeepSeek 4.1 review:

 Key high-severity:
 - A. Static files served by nginx bypass WebHare's rule/access system (auth, IP allow/deny, forcehttps, redirects, HSTS/addheaders, force_content_type, fixcase). Security + functional.
 - B. wh apply config / CI: TESTFW_WEBHARE_WEBSERVER doesn't reach the container build → nginx module not built → runtime nginxjs fails. (probable, medium confidence)
 - C. dataroot: null for unknown hosts + no default domain → empty root/cert. Potential info leak / broken SSL.

 Medium:
 - Cert model divergence (keystore-by-host vs port keypair) + staleness (60m cache, no invalidation on cert change/renew; wh apply nginx not triggered by webserver config changes).
 - getFileRoute reads the entire file for every .shtml/index.html request (nocache) — perf; also JSON.parse of the whole remainder is fragile.
 - index index.shtml index.html; order reversed vs WebHare's ["index.html","index.shtml"]; custom defaultpages ignored.
 - A/B test pages return 500 (FIXME).
 - Port selection: skips non-virtualhost ports (rescue) but includes internal trusted ports (-2/-3/-7/-8) — verify intent.
 - Connection: close set for all proxied requests (upstream keepalive disabled).
 - Build fragility: module tied to installed nginx version, not rebuilt on nginx upgrade; builds njs in-tree.

 Low/nits:
 - Makefile duplicate $(SRCDIR)/vendor/setup-nginx.sh dependency.
 - Brewfile brew "PCRE" casing (likely should be pcre); git redundant; pcre+pcre2 both.
 - setup-nginx.sh no trailing newline; NJS_QUICKJS=YES redundant.
 - Router comment about readFileSync/utf8 misleading.
 - console.log(e) in error path (should be console.error).
 - getFileRoute nocache unnecessary; js_var $file_redirect empty-string edge cases.
 - getLogTimestamp NaN edge case.
 - webserver.ts .ts extension import inconsistent with nginx.ts.
 - doc/nginx.md minimal.
 - sanitizeHost rejects underscores.

[unilynx]

Most missing functionality is intentional at this stage. It's not production ready yet. I've move these remarks to https://gitlab.webhare.com/webharebv/codekloppers/-/work_items/1374 as it's a nice checklist

At this point the question is - is there anything in the PR that affects WebHare if you didn't optin using WEBHARE_WEBSERVER=nginxjs

[webharebot]

🤖 Auto-Approved: PR author (@unilynx) is an internal organization/repository member.

[webharebot]

🤖 Auto-Approved: PR author (@unilynx) is an internal organization/repository member.