worker_processes auto;
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # ── Logging ──────────────────────────────────────────────────────
    log_format main '$remote_addr - $remote_user [$time_local] '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent" '
                    'rt=$request_time';
    access_log /var/log/nginx/access.log main;

    # ── Performance ──────────────────────────────────────────────────
    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout 65;

    # ── Gzip ─────────────────────────────────────────────────────────
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 1024;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml
        application/rss+xml
        image/svg+xml;

    # ── Upload size ──────────────────────────────────────────────────
    client_max_body_size 100m;

    # ── Rate limiting ────────────────────────────────────────────────
    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=30r/s;

    # ── Upstream: FastAPI backend ────────────────────────────────────
    upstream backend {
        server backend:8900;
        keepalive 32;
    }

    # ── Upstream: Java document converter ────────────────────────────
    upstream doc_converter {
        server doc-converter:18800;
        keepalive 8;
    }

    server {
        listen 10038;
        server_name _;

        # ── Security headers ─────────────────────────────────────────
        add_header X-Frame-Options        SAMEORIGIN always;
        add_header X-Content-Type-Options  nosniff always;
        add_header X-XSS-Protection       "1; mode=block" always;
        add_header Referrer-Policy        strict-origin-when-cross-origin always;

        # ── Vue SPA static files ─────────────────────────────────────
        location / {
            root /usr/share/nginx/html;
            index index.html;
            try_files $uri $uri/ /index.html;
        }

        # Hashed assets → aggressive caching (Vite generates unique filenames)
        location /assets/ {
            root /usr/share/nginx/html;
            expires 1y;
            add_header Cache-Control "public, immutable";
            access_log off;
        }

        # ── API: FastAPI backend (direct /api/v1) ────────────────────
        location /api/v1/ {
            limit_req zone=api_limit burst=20 nodelay;

            proxy_pass http://backend/api/v1/;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Connection        "";

            # SSE support (research streaming)
            proxy_buffering    off;
            proxy_cache        off;
            proxy_read_timeout 300s;
            chunked_transfer_encoding on;
        }

        # ── API: Legacy /api/ai → rewrite to /api on backend ────────
        location /api/ai/ {
            limit_req zone=api_limit burst=20 nodelay;

            rewrite ^/api/ai(/.*)$ /api$1 break;
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Connection        "";

            # SSE support
            proxy_buffering    off;
            proxy_cache        off;
            proxy_read_timeout 300s;
            chunked_transfer_encoding on;
        }

        # ── API: /api/biz → backend ─────────────────────────────────
        location /api/biz/ {
            limit_req zone=api_limit burst=20 nodelay;

            rewrite ^/api/biz(/.*)$ /api$1 break;
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Connection        "";
        }

        # ── API: Document converter ──────────────────────────────────
        location /api/converter/ {
            limit_req zone=api_limit burst=10 nodelay;

            rewrite ^/api/converter(/.*)$ /api$1 break;
            proxy_pass http://doc_converter;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout 120s;
        }

        # ── Health check (for Docker / load balancer) ────────────────
        location = /nginx-health {
            access_log off;
            return 200 "ok\n";
            add_header Content-Type text/plain;
        }
    }
}
