# =============================================================================
# KRONECTOR — Nginx Reverse Proxy Configuration
# =============================================================================
# Routes all services behind a single domain:
#   /api/*     → FastAPI   (port 8000)
#   /mlflow/*  → MLflow    (port 5000)
#   /          → Redirect to /api/docs
#
# For HTTPS, add a server block with ssl_certificate directives
# or use Certbot with the nginx plugin.
# =============================================================================

upstream api_backend {
    server api:8000;
}

upstream mlflow_backend {
    server mlflow:5000;
}



server {
    listen 80;
    server_name _;

    # --- Security headers ---
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # --- Default: redirect to API docs ---
    location = / {
        return 302 /api/docs;
    }

    # --- FastAPI ---
    location /api/ {
        proxy_pass http://api_backend/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Increase timeouts for ML inference (Groq API calls can take a few seconds)
        proxy_read_timeout 120s;
        proxy_connect_timeout 10s;
    }

    # --- MLflow Tracking UI ---
    location /mlflow/ {
        proxy_pass http://mlflow_backend/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }



    # --- Health check for load balancers / uptime monitors ---
    location /health {
        proxy_pass http://api_backend/health;
    }
}