nx_aw_mtls_proxy.nx

nx_aw_mtls_proxy.nx -- SOVEREIGN mTLS-TERMINATING reverse proxy = the no-JavaScript session carrier. Identical to the PROVEN nx_aw_tlsproxy (terminate TLS 1.3 + the real Let's Encrypt cert -> forward the decrypted HTTP to a loopback backend -> relay back encrypted, fork-per-connection, instant DNAT-flip rollback) EXCEPT it requests a CLIENT cert (mTLS via run_ecdsa_mtls) and, for a VERIFIED client cert, injects the cert Subject CN as X-Nishi-Cert-Identity into the forwarded request -- stripping any client- supplied copy first (the trust boundary, gated by nx_aw_mtls_inject_gate). A no-cert / bad-cert client is forwarded WITHOUT an identity (request-not-require: the backend falls back to its X-Nishi-Session header path = NEVER-LOCKOUT). So a top-level NAVIGATION carries identity at the TLS layer with ZERO JavaScript, ZERO cookies -- the sovereign answer the operator asked for. Live cutover = point .240:443 DNAT at NX_MP_PORT. argv[1] (optional) = listen port (default 9443); argv[2] (optional) = backend port (default 8443) license_tier: ORIGINAL