nginx-reverse-proxy: Add NGINX layer-4 proxying

[runleveldev]

Issue: Enable dynamic Layer 4 proxy and server configuration in Nginx

Description:
The current load balancer setup requires manual configuration updates to add or remove backend servers. This limits scalability and automation.

Recommendation:
Implement dynamic configuration using one of the following approaches:

• Nginx JavaScript (njs): use js_import to manage Layer 4 proxy logic dynamically.
• API-controlled configuration: generate and reload .conf files in conf.d through an application or management API.

Benefits:

• Enables automated provisioning and deprovisioning of backend servers
• Reduces downtime by avoiding full reloads for small changes
• Improves scalability and integration with orchestration systems
• Remove port-forwarding at the firewall layer

[runleveldev]

I want to use the NGINX to handle every port forward, including ssh. Maybe an exception for the proxmox webui ports as a sort of out-of-band if the nginx is down. This lets us have highly programatic access to the port forward configs, avoids requiring configuration at the shared firewall level, and persists the changes across reboots (unlike native iptables). Thoughts?

[runleveldev]

Plan:

1. Add stream block to nginx.conf
2. Dynamically generate stream.conf drop-ins via create-a-container API database ejs template
3. Pull stream.conf periodically to the nginx config, like with the http config
4. Update POST /containers callback to allocate layer-4 ports in addition to recording them in the database
5. After testing NGINX configs and deploying to prod, point all ports (1024-65535, tcp and udp) to the load balancer
6. Remove port-forwards from the Proxmox server