Move behind nginx reverse proxy: app binds 127.0.0.1:4567, nginx owns :80

Avoids the cap_net_bind_service dance breaking on every RVM ruby patch
upgrade (it happened today after today's ruby-4.0.7 install).

app.rb

@@ -8,8 +8,10 @@ require_relative 'lib/label_repository'
 
 set :protection, :except => :frame_options
 set :environment, :production
-set :bind, "::"
-set :port, 80
+# nginx reverse-proxies :80 -> here. Loopback-only and an unprivileged port
+# means no more cap_net_bind_service dance on every RVM ruby upgrade.
+set :bind, "127.0.0.1"
+set :port, 4567
 
 if !File.exist?('config.json') || !File.readable?('config.json')
   raise RuntimeException, 'Could not read config.json'

nginx-labelprint.conf

@@ -0,0 +1,20 @@
+# Installed at /etc/nginx/sites-available/labelprint on rpi-printserver
+# (symlinked into sites-enabled), not auto-deployed -- kept here just so a
+# reflash/rebuild isn't a guessing game. nginx owns :80 so the app itself
+# never needs cap_net_bind_service (which a plain RVM ruby patch upgrade
+# silently drops, since it's tied to the old binary's path).
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name rpi-printserver.hv.priesol.net;
+
+    client_max_body_size 20m;
+
+    location / {
+        proxy_pass http://127.0.0.1:4567;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}