# Include inside the existing HTTPS server block on fr1 AFTER creating an SSH tunnel.
# Reverse tunnel must bind only to fr1 127.0.0.1:18788 -> rpi 127.0.0.1:8788.
# No public port 8788/18788; VK uses the existing HTTPS listener.
location ^~ /marusia/webhook/ {
    access_log off;
    client_max_body_size 64k;
    limit_except POST { deny all; }
    proxy_connect_timeout 1s;
    proxy_read_timeout 5s;
    proxy_pass http://127.0.0.1:18788/webhook/;
}
# Add a limit_req zone in nginx http{} and apply its limit here before exposure.