# ─────────────────────────────────────────────────────────────────────────────
# SalmAlm — nginx reverse proxy config
# ─────────────────────────────────────────────────────────────────────────────
#
# Architecture:
#   HTTP  → nginx :80 → SalmAlm :18800
#   WS    → nginx :80 (Upgrade header) → SalmAlm WS :18801
#   HTTPS → nginx :443 (SSL termination) → same upstreams
#
# Usage:
#   sudo cp config/salmalm.nginx.conf /etc/nginx/sites-available/salmalm
#   sudo ln -s /etc/nginx/sites-available/salmalm /etc/nginx/sites-enabled/
#   sudo nginx -t && sudo systemctl reload nginx
#
# For HTTPS (recommended):
#   sudo certbot --nginx -d yourdomain.com
# ─────────────────────────────────────────────────────────────────────────────

# Route WebSocket connections to port 18801, HTTP to 18800
map $http_upgrade $salmalm_upstream {
    "websocket"  http://127.0.0.1:18801;
    default      http://127.0.0.1:18800;
}

# Normalize Connection header for WebSocket proxying
map $http_upgrade $connection_upgrade {
    default upgrade;
    ""      close;
}

# ── HTTP ──────────────────────────────────────────────────────────────────────
server {
    listen 80;
    listen [::]:80;
    server_name _;                    # replace with your domain or IP

    # Security headers
    add_header X-Content-Type-Options  nosniff;
    add_header X-Frame-Options         SAMEORIGIN;
    add_header Referrer-Policy         strict-origin-when-cross-origin;

    # Logging
    access_log /var/log/nginx/salmalm.access.log;
    error_log  /var/log/nginx/salmalm.error.log;

    # Increase body size for file uploads
    client_max_body_size 50M;

    location / {
        proxy_pass         $salmalm_upstream;
        proxy_http_version 1.1;

        # WebSocket upgrade headers (no-op for regular HTTP)
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # Standard proxy headers
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeouts — keep WS alive for long conversations
        proxy_read_timeout    3600s;
        proxy_send_timeout    3600s;
        proxy_connect_timeout   75s;

        # Disable buffering for SSE (server-sent events) streaming
        proxy_buffering       off;
        proxy_cache           off;
    }
}

# ── HTTPS (uncomment after `certbot --nginx`) ─────────────────────────────────
# server {
#     listen 443 ssl http2;
#     listen [::]:443 ssl http2;
#     server_name yourdomain.com;
#
#     ssl_certificate     /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
#     ssl_protocols       TLSv1.2 TLSv1.3;
#     ssl_ciphers         HIGH:!aNULL:!MD5;
#
#     add_header Strict-Transport-Security "max-age=63072000" always;
#
#     client_max_body_size 50M;
#
#     location / {
#         proxy_pass         $salmalm_upstream;
#         proxy_http_version 1.1;
#         proxy_set_header Upgrade    $http_upgrade;
#         proxy_set_header Connection $connection_upgrade;
#         proxy_set_header Host              $host;
#         proxy_set_header X-Real-IP         $remote_addr;
#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_read_timeout    3600s;
#         proxy_send_timeout    3600s;
#         proxy_connect_timeout   75s;
#         proxy_buffering       off;
#         proxy_cache           off;
#     }
# }

# ── HTTP → HTTPS redirect (uncomment after SSL setup) ─────────────────────────
# server {
#     listen 80;
#     server_name yourdomain.com;
#     return 301 https://$host$request_uri;
# }
