worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;

events {
  worker_connections 1024;
}

http {
  include /etc/nginx/mime.types;
  default_type application/octet-stream;
  client_max_body_size 100M;

  upstream api_upstream {
    server api:8000;
  }

  upstream web_upstream {
    server web:3000;
  }

  server {
    listen 80;
    server_name localhost;

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    # Note: HSTS removed for local dev - enable in production with HTTPS
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # FastAPI backend
    location /api/v1/ {
      proxy_pass http://api_upstream;
      proxy_http_version 1.1;
      proxy_read_timeout 30m;
      proxy_connect_timeout 30m;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      # SSE support
      proxy_set_header Connection '';
      proxy_buffering off;
      proxy_cache off;
      chunked_transfer_encoding off;
    }

    # Swagger docs
    location /docs {
      proxy_pass http://api_upstream/docs;
      proxy_read_timeout 30m;
      proxy_connect_timeout 30m;
    }

    location /openapi.json {
      proxy_pass http://api_upstream/openapi.json;
      proxy_read_timeout 30m;
      proxy_connect_timeout 30m;
    }

    # Static files from volume
    location /app_data/images/ {
      alias /app_data/images/;
      expires 1y;
      add_header Cache-Control "public, immutable";
    }

    location /app_data/exports/ {
      alias /app_data/exports/;
      expires 1y;
      add_header Cache-Control "public, immutable";
    }

    location /app_data/uploads/ {
      alias /app_data/uploads/;
      expires 1y;
      add_header Cache-Control "public, immutable";
    }

    location /app_data/fonts/ {
      alias /app_data/fonts/;
      expires 1y;
      add_header Cache-Control "public, immutable";
    }

    # Static backend assets
    location /static {
      alias /app_data/static/;
      expires 1y;
      add_header Cache-Control "public, immutable";
    }

    # Next.js frontend (catch-all)
    location / {
      proxy_pass http://web_upstream;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_read_timeout 30m;
      proxy_connect_timeout 30m;
    }
  }
}