# Front proxy config for the HOST (system) nginx on the VPS.
# This is the single entrypoint owning 80/443:
#   - «Контракт-чек» (DealDocumentScreening) edge container -> 127.0.0.1:8081
#   - homelab-stack nginx container                      -> 127.0.0.1:8088
#
# Install:
#   sudo cp front.conf /etc/nginx/sites-available/apps
#   sudo ln -s /etc/nginx/sites-available/apps /etc/nginx/sites-enabled/
#   sudo rm -f /etc/nginx/sites-enabled/default
#   sudo nginx -t && sudo systemctl reload nginx
#
# TLS later: `sudo certbot --nginx -d your.domain` rewrites the 80-block and
# adds the 443 server automatically (install python3-certbot-nginx first).

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# Backends (containers must publish on 127.0.0.1, see deploy/vps/README or override)
upstream contract_check_edge { server 127.0.0.1:8081; }
upstream homelab_nginx      { server 127.0.0.1:8088; }

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # Let's Encrypt renewal (host certbot, webroot mode) — keep even after TLS is on
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # ── «Контракт-чек»: exact path set of its edge (contract-check-http.conf.template)
    location ~ ^/(healthz|readyz|metrics|api/|admin/|docs|openapi\.json) {
        proxy_pass http://contract_check_edge;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Correlation-Id  $http_x_correlation_id;
        client_max_body_size 50M;          # large contract uploads
        proxy_read_timeout 120s;
        proxy_buffering off;
    }

    location /webhook/ {
        proxy_pass http://contract_check_edge;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
    }

    # ── everything else: homelab-stack (landing page, /homepage/, /dozzle/, ...)
    location / {
        proxy_pass http://homelab_nginx;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade           $http_upgrade;    # dozzle/kuma websockets
        proxy_set_header Connection        $connection_upgrade;
        proxy_read_timeout 60s;
    }
}