Yay I have working nginx conf, I will write a medium post so others can do it too because it needn't be such a mystery

Zoinks!

What specifically were you working on RE: nginx?

splitting UI and agent traffic, having an LE cert for UI and using my self signed cert using ed448 (for CA) and ed25519 (for server) for the agent api. All the doco I could find was using old kolide endpoints that don't exist anymore or have been renamed. Also split the domains so for e.g. ui.fleet.mydomain.com and api.fleet.mydomain.com (didn't use this naming scheme tho) so the UI is accessed on a different domain than the agents use. This also allows me to set up a honey pot that looks for anything trying to access the api on my UI domain, or anything trying to access the UI on my api domain :)

ya, I do need to update my post to use the non-kolide endpoints (https://defensivedepth.com/2020/04/02/kolide-fleet-breaking-out-the-osquery-api-web-ui/)

@defensivedepth yes yours was my starting point (and I'll reference it so in my article)