# DC Overview - Nginx Reverse Proxy Configuration (Docker)
# Generated by dc-overview setup
#
# This config works with Docker networking where services are accessed
# by container name (e.g., grafana:3000, prometheus:9090, dc-overview:5001)

worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent"';

    access_log /var/log/nginx/access.log main;
    sendfile on;
    keepalive_timeout 65;
    client_max_body_size 100M;

    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml;

    # HTTP server - redirect to HTTPS
    server {
        listen 80;
        server_name {{ domain or '_' }};
        
{% if use_letsencrypt %}
        # Let's Encrypt ACME challenge
        location /.well-known/acme-challenge/ {
            root /var/www/certbot;
        }
{% endif %}
        
        location / {
            return 301 https://$host$request_uri;
        }
    }

    # HTTPS server
    server {
        listen 443 ssl http2;
        server_name {{ domain or '_' }};

        ssl_certificate {{ ssl_cert | default('/etc/nginx/ssl/server.crt') }};
        ssl_certificate_key {{ ssl_key | default('/etc/nginx/ssl/server.key') }};
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_prefer_server_ciphers off;
        ssl_session_cache shared:SSL:10m;

        # Security headers
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Strict-Transport-Security "max-age=31536000" always;

        # Health check endpoint
        location /api/health {
            default_type application/json;
            return 200 '{"status":"ok","proxy":"running"}';
        }

        # Services health (for landing page)
        location /api/services {
            default_type application/json;
            # Dynamically check services - placeholder response
            return 200 '{"dc-overview":{"running":true},"grafana":{"running":true},"prometheus":{"running":true}{% if ipmi_enabled %},"ipmi-monitor":{"running":true}{% endif %}}';
        }

        # ===========================================================================
        # DC Overview at /dc/
        # ===========================================================================
        location /dc/ {
            proxy_pass http://dc-overview:{{ dc_port | default(5001) }}/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Script-Name /dc;
            proxy_read_timeout 300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout 300s;
        }

{% if ipmi_enabled %}
        # ===========================================================================
        # IPMI Monitor at /ipmi/
        # ===========================================================================
        location /ipmi/ {
            proxy_pass http://ipmi-monitor:5000/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Script-Name /ipmi;
            proxy_read_timeout 300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout 300s;
        }
{% endif %}

        # ===========================================================================
        # Grafana at /grafana/ (configured with GF_SERVER_SERVE_FROM_SUB_PATH=true)
        # ===========================================================================
        location /grafana/ {
            # No trailing slash - preserve /grafana/ prefix for Grafana
            proxy_pass http://grafana:3000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 86400;
            proxy_send_timeout 86400;
            
            # Inject Fleet Management Home button into Grafana HTML
            # target="_top" prevents Grafana's SPA router from intercepting the click
            sub_filter '</head>' '<style>.fleet-home-bar{position:fixed;top:0;left:0;right:0;z-index:99999;background:#1a1a2e;border-bottom:1px solid #333;padding:4px 16px;display:flex;align-items:center;gap:10px;font-family:-apple-system,sans-serif;font-size:13px;height:28px;}.fleet-home-bar a{color:#00b4d8;text-decoration:none;border:1px solid #00b4d8;padding:3px 12px;border-radius:4px;font-size:12px;font-weight:500;transition:background 0.2s;}.fleet-home-bar a:hover{background:rgba(0,180,216,0.15);}.fleet-home-bar span{color:#666;}body{padding-top:36px !important;}</style></head>';
            sub_filter '</body>' '<div class="fleet-home-bar"><a href="/" target="_top">Home</a><span>|</span><span style="color:#888;">Grafana</span></div></body>';
            sub_filter_once on;
            sub_filter_types text/html;
            proxy_set_header Accept-Encoding "";
            
            proxy_intercept_errors on;
            error_page 502 503 504 = @service_unavailable;
        }

        # ===========================================================================
        # Prometheus at /prometheus/
        # ===========================================================================
        location /prometheus/ {
            proxy_pass http://prometheus:9090/prometheus/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # Inject Fleet Management Home button into Prometheus HTML
            sub_filter '</head>' '<style>.fleet-home-bar{position:fixed;top:0;left:0;right:0;z-index:99999;background:#1a1a2e;border-bottom:1px solid #333;padding:4px 16px;display:flex;align-items:center;gap:10px;font-family:-apple-system,sans-serif;font-size:13px;height:28px;}.fleet-home-bar a{color:#00b4d8;text-decoration:none;border:1px solid #00b4d8;padding:3px 12px;border-radius:4px;font-size:12px;font-weight:500;transition:background 0.2s;}.fleet-home-bar a:hover{background:rgba(0,180,216,0.15);}.fleet-home-bar span{color:#666;}</style></head>';
            sub_filter '</body>' '<div class="fleet-home-bar"><a href="/">Home</a><span>|</span><span style="color:#888;">Prometheus</span></div></body>';
            sub_filter_once on;
            sub_filter_types text/html;
            proxy_set_header Accept-Encoding "";
            
            proxy_intercept_errors on;
            error_page 502 503 504 = @service_unavailable;
        }

        # Service unavailable fallback
        location @service_unavailable {
            default_type application/json;
            return 503 '{"error":"Service unavailable","message":"The requested service is not running"}';
        }

        # ===========================================================================
        # Fleet Management Landing Page at /
        # ===========================================================================
        location / {
            root /usr/share/nginx/html;
            try_files $uri $uri/ /index.html;
        }
    }
}
