events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout  65;

    # Rate limiting zone
    limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;

    upstream mac_api {
        server mac:8000;
        keepalive 32;
    }

    # ── HTTP → HTTPS redirect ────────────────────────────────
    server {
        listen 80;
        server_name _;
        return 301 https://$host$request_uri;
    }

    # ── HTTPS server ─────────────────────────────────────────
    server {
        listen 443 ssl http2;
        server_name _;

        # SSL — replace with your cert paths (or use Certbot / self-signed)
        ssl_certificate     /etc/nginx/ssl/cert.pem;
        ssl_certificate_key /etc/nginx/ssl/key.pem;
        ssl_protocols       TLSv1.2 TLSv1.3;
        ssl_ciphers         HIGH:!aNULL:!MD5;
        ssl_session_cache   shared:SSL:10m;
        ssl_session_timeout 10m;

        # Security headers
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header X-Frame-Options DENY always;
        add_header X-Content-Type-Options nosniff always;
        add_header Referrer-Policy strict-origin-when-cross-origin always;

        # Max upload size
        client_max_body_size 512m;

        # SvelteKit frontend
        root /app;

        location / {
            try_files $uri $uri/ /index.html;
        }

        location /_app/immutable/ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }

        location = /sw.js {
            add_header Service-Worker-Allowed /;
            add_header Cache-Control "no-cache, no-store, must-revalidate";
        }

        location = /manifest.json {
            add_header Cache-Control "public, max-age=3600";
        }

        # API proxy
        location /api/ {
            limit_req zone=api burst=30 nodelay;
            proxy_pass http://mac_api;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_http_version 1.1;
            proxy_set_header Connection "";

            # SSE streaming
            proxy_buffering off;
            proxy_cache off;
            proxy_read_timeout 300s;
        }

        # WebSocket proxy (notebook kernels)
        location /ws/ {
            proxy_pass http://mac_api;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_read_timeout 86400s;
        }

        # Docs
        location ~ ^/(docs|redoc|openapi\.json) {
            proxy_pass http://mac_api;
            proxy_set_header Host $host;
        }

        # Health check
        location /nginx-health {
            return 200 'ok';
            add_header Content-Type text/plain;
        }
    }
}