# Upstream Django application
upstream django {
    server web:8000;
}

# HTTP server - serve content directly
server {
    listen 80;
    server_name localhost 173.212.199.208;
    
    # Root directory
    root /var/www;
    
    # Static files
    location /static/ {
        alias /var/www/static/;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }
    
    # Media files
    location /media/ {
        alias /var/www/media/;
        expires 1y;
        add_header Cache-Control "public";
        access_log off;
    }
    
    # VAST ad serving - high performance, no rate limiting
    location /vast/ {
        proxy_pass http://django;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # VAST specific optimizations
        proxy_buffering off;
        proxy_cache_bypass $http_upgrade;
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
        
        # Apply VAST rate limiting
        limit_req zone=vast burst=200 nodelay;
        
        # CORS headers for VAST
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        
        # Handle preflight requests
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin "*";
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
            add_header Access-Control-Allow-Headers "Content-Type, Authorization";
            add_header Access-Control-Max-Age 1728000;
            add_header Content-Type "text/plain; charset=utf-8";
            add_header Content-Length 0;
            return 204;
        }
    }
    
    # API endpoints
    location /api/ {
        proxy_pass http://django;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Apply API rate limiting
        limit_req zone=api burst=20 nodelay;
        
        # API timeouts
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
    
    # Health check endpoint
    location /health/ {
        proxy_pass http://django;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        access_log off;
    }
    
    # Django admin
    location /admin/ {
        proxy_pass http://django;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Longer timeouts for admin
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
    }
    
    # All other Django requests
    location / {
        proxy_pass http://django;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Standard timeouts
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
    
    # Error pages
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
    
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}

# HTTPS server - commented out for HTTP-only access
# server {
#     listen 443 ssl http2;
#     server_name localhost;
#     
#     # SSL Configuration
#     ssl_certificate /etc/nginx/ssl/cert.pem;
#     ssl_certificate_key /etc/nginx/ssl/key.pem;
#     
#     ssl_protocols TLSv1.2 TLSv1.3;
#     ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
#     ssl_prefer_server_ciphers off;
#     ssl_session_cache shared:SSL:10m;
#     ssl_session_timeout 10m;
#     
#     # Security headers
#     add_header X-Frame-Options "SAMEORIGIN" always;
#     add_header X-XSS-Protection "1; mode=block" always;
#     add_header X-Content-Type-Options "nosniff" always;
#     add_header Cross-Origin-Opener-Policy "same-origin" always;
#     add_header Cross-Origin-Embedder-Policy "require-corp" always;
#     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
#     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
#     
#     # Root directory
#     root /var/www;
#     
#     # Static files
#     location /static/ {
#         alias /var/www/static/;
#         expires 1y;
#         add_header Cache-Control "public, immutable";
#         access_log off;
#     }
#     
#     # Media files
#     location /media/ {
#         alias /var/www/media/;
#         expires 1y;
#         add_header Cache-Control "public";
#         access_log off;
#     }
#     
#     # VAST ad serving - high performance, no rate limiting
#     location /vast/ {
#         proxy_pass http://django;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         
#         # VAST specific optimizations
#         proxy_buffering off;
#         proxy_cache_bypass $http_upgrade;
#         proxy_connect_timeout 5s;
#         proxy_send_timeout 10s;
#         proxy_read_timeout 10s;
#         
#         # Apply VAST rate limiting
#         limit_req zone=vast burst=200 nodelay;
#         
#         # CORS headers for VAST
#         add_header Access-Control-Allow-Origin "*" always;
#         add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
#         add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
#         
#         # Handle preflight requests
#         if ($request_method = 'OPTIONS') {
#             add_header Access-Control-Allow-Origin "*";
#             add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
#             add_header Access-Control-Allow-Headers "Content-Type, Authorization";
#             add_header Access-Control-Max-Age 1728000;
#             add_header Content-Type "text/plain; charset=utf-8";
#             add_header Content-Length 0;
#             return 204;
#         }
#     }
#     
#     # API endpoints
#     location /api/ {
#         proxy_pass http://django;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         
#         # Apply API rate limiting
#         limit_req zone=api burst=20 nodelay;
#         
#         # API timeouts
#         proxy_connect_timeout 30s;
#         proxy_send_timeout 30s;
#         proxy_read_timeout 30s;
#     }
#     
#     # Health check endpoint
#     location /health/ {
#         proxy_pass http://django;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         
#         access_log off;
#     }
#     
#     # Django admin
#     location /admin/ {
#         proxy_pass http://django;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         
#         # Longer timeouts for admin
#         proxy_connect_timeout 60s;
#         proxy_send_timeout 60s;
#         proxy_read_timeout 60s;
#     }
#     
#     # All other Django requests
#     location / {
#         proxy_pass http://django;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         
#         # Standard timeouts
#         proxy_connect_timeout 30s;
#         proxy_send_timeout 30s;
#         proxy_read_timeout 30s;
#     }
#     
#     # Error pages
#     error_page 404 /404.html;
#     error_page 500 502 503 504 /50x.html;
#     
#     location = /50x.html {
#         root /usr/share/nginx/html;
#     }
# }