# Kredo Discovery API — nginx reverse proxy
# Site: api.aikredo.com → uvicorn on 127.0.0.1:8000

server {
    listen 80;
    server_name api.aikredo.com;

    # Redirect HTTP to HTTPS (certbot will manage this)
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name api.aikredo.com;

    # SSL certs managed by certbot
    ssl_certificate /etc/letsencrypt/live/api.aikredo.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.aikredo.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # Proxy to uvicorn
    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts
        proxy_connect_timeout 10s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
    }

    # Rate limit zone (10 req/s per IP for writes)
    # Read endpoints are unlimited at the nginx level
}

# Kredo Web App redirect
# Site: app.aikredo.com → https://aikredo.com/app/

server {
    listen 80;
    server_name app.aikredo.com;
    return 301 https://aikredo.com/app/;
}

server {
    listen 443 ssl;
    server_name app.aikredo.com;

    ssl_certificate /etc/letsencrypt/live/app.aikredo.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/app.aikredo.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    return 301 https://aikredo.com/app/;
}
