# nginx.conf — Reverse proxy devant Streamlit pour HF Spaces
#
# Rôle :
#   - Écoute sur le port public 7860 (requis par HF Spaces)
#   - Proxie vers Streamlit sur le port interne 7861
#   - Supprime X-Frame-Options pour autoriser l'embedding dans l'iframe HF Spaces
#   - Ajoute Content-Security-Policy: frame-ancestors * pour les navigateurs modernes
#
# Non-root : tous les fichiers temporaires pointent vers /tmp (accessible à UID 1000)

worker_processes 1;
pid /tmp/nginx.pid;
error_log /tmp/nginx_error.log warn;
daemon off;

events {
    worker_connections 1024;
}

http {
    access_log off;

    # Chemins temporaires accessibles à l'utilisateur non-root (UID 1000)
    client_body_temp_path /tmp/nginx_client_body;
    proxy_temp_path        /tmp/nginx_proxy;
    fastcgi_temp_path      /tmp/nginx_fastcgi;
    uwsgi_temp_path        /tmp/nginx_uwsgi;
    scgi_temp_path         /tmp/nginx_scgi;

    server {
        listen 7860;

        # ── WebSocket Streamlit (/_stcore/stream) ──────────────────────────
        location /_stcore/stream {
            proxy_pass         http://127.0.0.1:7861;
            proxy_http_version 1.1;
            proxy_set_header   Upgrade    $http_upgrade;
            proxy_set_header   Connection "Upgrade";
            proxy_set_header   Host       $host;
            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
        }

        # ── Toutes les autres requêtes HTTP ────────────────────────────────
        location / {
            proxy_pass         http://127.0.0.1:7861;
            proxy_http_version 1.1;
            proxy_set_header   Upgrade           $http_upgrade;
            proxy_set_header   Connection        "upgrade";
            proxy_set_header   Host              $host;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;

            # Autoriser l'iframe depuis n'importe quelle origine (HF Spaces)
            proxy_hide_header  X-Frame-Options;
            add_header         Content-Security-Policy "frame-ancestors *" always;
        }
    }
}