# Front proxy config for the HOST (system) nginx on the VPS.
# This is the single entrypoint owning 80/443:
#   - «Контракт-чек» (DealDocumentScreening) edge container -> 127.0.0.1:8081
#   - homelab-stack nginx container                      -> 127.0.0.1:8088
#
# TLS: cert obtained on the host (webroot/webroot-nginx), paths below.
# Renewal: host certbot reuses /.well-known/acme-challenge/ on :80.
#
# Install:
#   sudo cp front.conf /etc/nginx/sites-available/apps
#   sudo ln -s /etc/nginx/sites-available/apps /etc/nginx/sites-enabled/apps
#   sudo rm -f /etc/nginx/sites-enabled/default /etc/nginx/sites-enabled/legaldoc.tw1.su
#   sudo nginx -t && sudo systemctl reload nginx

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# Backends (containers publish on 127.0.0.1, see docker-compose.override.example.yml)
upstream contract_check_edge { server 127.0.0.1:8081; }
upstream homelab_nginx      { server 127.0.0.1:8088; }

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name legaldoc.tw1.su;

    ssl_certificate     /etc/letsencrypt/live/legaldoc.tw1.su/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/legaldoc.tw1.su/privkey.pem;

    # Let's Encrypt renewal (host certbot, webroot mode)
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    # ── «Контракт-чек»: exact path set of its edge (contract-check-http.conf.template)
    # Grafana is also routed through the edge container under /grafana.
    location ~ ^/(healthz|readyz|metrics|api/|admin/|docs|openapi\.json|grafana/) {
        proxy_pass http://contract_check_edge;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Correlation-Id  $http_x_correlation_id;
        client_max_body_size 50M;          # large contract uploads
        proxy_read_timeout 120s;
        proxy_buffering off;
    }

    location /webhook/ {
        proxy_pass http://contract_check_edge;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
    }

    # ── everything else: homelab-stack (landing page, /homepage/, /dozzle/, ...)
    location / {
        proxy_pass http://homelab_nginx;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade           $http_upgrade;    # dozzle/kuma websockets
        proxy_set_header Connection        $connection_upgrade;
        proxy_read_timeout 60s;
    }
}