# Adtlas DAI Nginx Server Configuration
# Handles static files, media files, and proxies to Django application

upstream django_app {
    # Django application server
    server web:8000;
    keepalive 32;
}

# HTTP to HTTPS redirect (for production)
server {
    listen 80;
    server_name _;
    
    # Health check endpoint
    location /health/ {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
    
    # Redirect all HTTP traffic to HTTPS in production
    # return 301 https://$server_name$request_uri;
    
    # For development, proxy directly to Django
    location / {
        proxy_pass http://django_app;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_redirect off;
        
        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
    
    # Static files
    location /static/ {
        alias /app/static/;
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header X-Content-Type-Options nosniff;
    }
    
    # Media files
    location /media/ {
        alias /app/media/;
        expires 1M;
        add_header Cache-Control "public";
        add_header X-Content-Type-Options nosniff;
    }
}

# # HTTPS server configuration (for production)
# server {
#     listen 443 ssl http2;
#     server_name _;
    
#     # SSL configuration (add your certificates)
#     # ssl_certificate /path/to/certificate.crt;
#     # ssl_certificate_key /path/to/private.key;
    
#     # SSL security settings
#     ssl_protocols TLSv1.2 TLSv1.3;
#     ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384;
#     ssl_prefer_server_ciphers off;
#     ssl_session_cache shared:SSL:10m;
#     ssl_session_timeout 10m;
    
#     # Security headers
#     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
#     add_header X-Frame-Options DENY always;
#     add_header X-Content-Type-Options nosniff always;
#     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
#     add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; child-src 'none'; frame-ancestors 'none'; form-action 'self'; base-uri 'self';" always;
    
#     # Health check endpoint
#     location /health/ {
#         access_log off;
#         return 200 "healthy\n";
#         add_header Content-Type text/plain;
#     }
    
#     # API endpoints with rate limiting
#     location /api/ {
#         limit_req zone=api burst=20 nodelay;
#         proxy_pass http://django_app;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_redirect off;
#     }
    
#     # Login endpoints with stricter rate limiting
#     location /auth/login/ {
#         limit_req zone=login burst=5 nodelay;
#         proxy_pass http://django_app;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_redirect off;
#     }
    
#     # Main application
#     location / {
#         proxy_pass http://django_app;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_redirect off;
        
#         # Timeouts
#         proxy_connect_timeout 60s;
#         proxy_send_timeout 60s;
#         proxy_read_timeout 60s;
#     }
    
#     # Static files with long cache
#     location /static/ {
#         alias /app/static/;
#         expires 1y;
#         add_header Cache-Control "public, immutable";
#         add_header X-Content-Type-Options nosniff;
        
#         # Gzip static files
#         location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)$ {
#             expires 1y;
#             add_header Cache-Control "public, immutable";
#             gzip_static on;
#         }
#     }
    
#     # Media files with moderate cache
#     location /media/ {
#         alias /app/media/;
#         expires 1M;
#         add_header Cache-Control "public";
#         add_header X-Content-Type-Options nosniff;
        
#         # Secure media access (add authentication if needed)
#         # auth_request /auth/check/;
#     }
    
#     # Deny access to sensitive files
#     location ~ /\. {
#         deny all;
#         access_log off;
#         log_not_found off;
#     }
    
#     location ~ ~$ {
#         deny all;
#         access_log off;
#         log_not_found off;
#     }
# }