# TipSharks Production Nginx Configuration
#
# This is a starting point for production deployments.
# In production you should:
#   - Configure SSL certificates (Let's Encrypt / certbot)
#   - Set a proper server_name
#   - Add rate limiting
#   - Tune worker_connections and buffer sizes

events {
    worker_connections 1024;
}

http {
    # ------------------------------------------------------------------
    # Upstreams
    # ------------------------------------------------------------------

    upstream elo_api {
        server tipsharks-elo-api:8000;
    }

    upstream ingest_api {
        server tab-api-ingest:9090;
    }

    upstream client_backend {
        server tipsharks-client-backend:8001;
    }

    # ------------------------------------------------------------------
    # HTTP -> HTTPS redirect (uncomment when SSL is configured)
    # ------------------------------------------------------------------
    # server {
    #     listen 80;
    #     server_name yourdomain.com app.yourdomain.com;
    #     return 301 https://$host$request_uri;
    # }

    # ------------------------------------------------------------------
    # Main server block (HTTP — use HTTPS in production)
    # ------------------------------------------------------------------

    server {
        listen 80;
        server_name _;

        # ----------------------------------------
        # Elo API routes
        # ----------------------------------------
        location /api/v1/ {
            proxy_pass http://elo_api/v1/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # ----------------------------------------
        # Client backend routes
        # ----------------------------------------
        location /api/ {
            proxy_pass http://client_backend/api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # ----------------------------------------
        # Ingest service routes (metrics, health)
        # ----------------------------------------
        location /ingest/ {
            proxy_pass http://ingest_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # ----------------------------------------
        # Default — fallthrough to Elo API (Web UI)
        # ----------------------------------------
        location / {
            proxy_pass http://elo_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # ----------------------------------------
        # Security headers (hardened baseline)
        # ----------------------------------------
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    }
}
