[badrogger]

This pull request introduces a new rpc-proxy command for all node types (active and passive, for both standard and Fair nodes) to control whether sChain RPC ports are served by nginx, along with supporting documentation and infrastructure changes. It also updates the firewall (nftables) logic to dynamically manage TLS service ports based on certificate presence, and refactors nginx configuration paths for improved maintainability.

New CLI command for RPC proxy management:

• Added a shared rpc-proxy command (node_cli/cli/rpc_proxy.py) to the CLI for all node types, allowing users to override on a per-node basis whether sChain RPC ports are served by nginx or not (on, off, or default). This command is now included in the command groups for standard nodes, passive nodes, Fair nodes, and passive Fair nodes. [1] [2] [3] [4] [5] [6] [7] [8] [9]

Documentation updates:

• Updated the README.md to document the new rpc-proxy command for all relevant node types, including usage, arguments, and operational notes about when changes take effect. [1] [2] [3] [4]

Nginx configuration improvements:

• Refactored nginx configuration paths and constants to support a directory-based structure, introduced support for base and chain-specific configuration files, and added lock file usage for safe concurrent changes.

Firewall (nftables) enhancements:

• Updated nftables logic to manage TLS service ports (HTTPS and Watchdog HTTPS) dynamically: these ports are only opened in the firewall when SSL certificates are present, and closed otherwise. This includes a new sync_tls_accepts method and a sync_tls_ports function to keep the firewall in sync with certificate state. [1] [2] [3]

Other infrastructure and bugfixes:

• Improved detection of node initialization state to support both legacy and new nginx config locations. [1] [2]
• Minor refactoring in nftables.py for code clarity and maintainability. [1] [2] [3]