worker_processes auto;

events {
  worker_connections 1024;
}

http {
  # Upstreams resolve to compose service names on the private network.
  upstream backend {
    server backend:4000;
  }
  upstream centrifugo {
    server centrifugo:8000;
  }
  upstream minio {
    server minio:9000;
  }

  server {
    listen 80;
    server_name _;
    # Emit path-only redirects so the externally-mapped port isn't dropped.
    absolute_redirect off;

    # REST API — strip the /api prefix before proxying to the backend.
    # $http_host (not $host) keeps the port: the backend presigns media URLs
    # for the exact origin the client used to reach this gateway.
    location /api/ {
      proxy_pass http://backend/;
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Object storage through the same origin as the API, so presigned URLs work
    # from any client that can reach this gateway (browsers AND phones). Paths
    # match the bucket names (media, avatars). Host must be preserved verbatim —
    # S3 v4 signatures cover it.
    location /media/ {
      proxy_pass http://minio;
      proxy_set_header Host $http_host;
      proxy_buffering off;
      client_max_body_size 200m;
    }
    location /avatars/ {
      proxy_pass http://minio;
      proxy_set_header Host $http_host;
      proxy_buffering off;
      client_max_body_size 25m;
    }

    # Swagger UI + OpenAPI spec — served by the backend at /docs (HTML, static
    # assets and /docs/json all live under this prefix; pass through unmodified).
    # Redirect the slashless form so the UI's relative asset paths resolve.
    location = /docs {
      return 301 /docs/;
    }
    location /docs {
      proxy_pass http://backend;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Realtime WebSocket — Centrifugo (receive-only client socket).
    location /connection/websocket {
      proxy_pass http://centrifugo;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_read_timeout 3600s;
    }

    location / {
      default_type text/plain;
      return 200 "Zovi gateway — /api/* -> backend, /connection/websocket -> centrifugo\n";
    }
  }
}