# 巡樓 Console nginx 設定 - 開發環境版（Vite + Go）
#
# 目標網域：https://threads-tool.30cm.net
# 路由規則：
#   /      → 前端 Vite dev server (127.0.0.1:5173)
#   /api/  → 後端 Go API gateway     (127.0.0.1:8890)
#
# 使用方式：
#   1. 確認前後端已啟動：
#        make run
#        make web-dev
#
#   2. 複製設定（需 sudo）：
#        sudo cp infra/nginx/haixun-dev.conf /etc/nginx/conf.d/haixun.conf
#        sudo nginx -t
#        sudo systemctl reload nginx
#
#   3. 測試：
#        curl http://threads-tool.30cm.net/health
#        瀏覽器開 http://threads-tool.30cm.net （或 https）
#
# SSL 建議：
#   - 先用 http 測試（目前預設）
#   - 有憑證後再啟用 https 區塊（見文末）
#
# 包含：
#   - Vite HMR websocket 支援
#   - /api SSE 完整長連線設定（AI stream、job 進度等）
#   - 正確轉發 Authorization / X-Member-Authorization

upstream haixun_backend {
    server 127.0.0.1:8890;
    keepalive 32;
}

upstream haixun_frontend {
    server 127.0.0.1:5173;
}

# =============================================
# 主要 server（目前預設 http，方便開發測試）
# =============================================
server {
    listen 80;
    listen [::]:80;
    server_name threads-tool.30cm.net;

    # ========== 前端 Vite ==========
    location / {
        proxy_pass http://haixun_frontend;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Vite HMR (Hot Module Replacement) 必須開啟
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 開發環境避免快取問題
        proxy_cache_bypass $http_upgrade;

        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
    }

    # 舊版 Threads OAuth callback（與 /api/v1/threads-accounts/oauth/callback 等價）
    location = /api/threads/oauth/callback {
        proxy_pass http://haixun_backend/api/v1/threads-accounts/oauth/callback$is_args$args;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # MinIO 公開資源（頭像等）；避免瀏覽器直接打 127.0.0.1:9000
    location /haixun-assets/ {
        proxy_pass http://127.0.0.1:9000;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
    }

    # ========== 後端 API ==========
    location /api/ {
        proxy_pass http://haixun_backend;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 讓前端帶的 provider token 與會員 JWT 通過
        proxy_set_header Authorization $http_authorization;
        proxy_set_header X-Member-Authorization $http_x_member_authorization;

        # 強制 SSE / 串流行為（非常重要）
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding off;
        proxy_ignore_headers "X-Accel-Buffering";

        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
    }

    # 方便健康檢查
    location = /health {
        proxy_pass http://haixun_backend/api/v1/health;
        proxy_set_header Host $host;
    }
}

# =============================================
# 進階：啟用 HTTPS（有 SSL 憑證時使用）
# =============================================
# 步驟：
#   1. 取得憑證（推薦 certbot）
#        sudo certbot --nginx -d threads-tool.30cm.net
#   2. 把上面整個 server { ... } 區塊註解或移除
#   3. 取消下面兩個 server block 的註解
#   4. 確認 ssl_certificate 路徑正確
#   5. nginx -t && systemctl reload nginx
#
# server {
#     listen 80;
#     listen [::]:80;
#     server_name threads-tool.30cm.net;
#     return 301 https://$host$request_uri;
# }
#
# server {
#     listen 443 ssl http2;
#     listen [::]:443 ssl http2;
#     server_name threads-tool.30cm.net;
#
#     # 請根據實際憑證路徑修改
#     ssl_certificate     /etc/letsencrypt/live/threads-tool.30cm.net/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/threads-tool.30cm.net/privkey.pem;
#
#     ssl_protocols TLSv1.2 TLSv1.3;
#     ssl_ciphers HIGH:!aNULL:!MD5;
#     ssl_prefer_server_ciphers off;
#
#     add_header X-Content-Type-Options "nosniff" always;
#     add_header X-Frame-Options "SAMEORIGIN" always;
#     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
#
#     # 前端
#     location / {
#         proxy_pass http://haixun_frontend;
#         proxy_http_version 1.1;
#         proxy_set_header Host              $host;
#         proxy_set_header X-Real-IP         $remote_addr;
#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_set_header Upgrade    $http_upgrade;
#         proxy_set_header Connection "upgrade";
#     }
#
#     # API
#     location /api/ {
#         proxy_pass http://haixun_backend;
#         proxy_http_version 1.1;
#         proxy_set_header Host              $host;
#         proxy_set_header X-Real-IP         $remote_addr;
#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_set_header Authorization $http_authorization;
#         proxy_set_header X-Member-Authorization $http_x_member_authorization;
#         proxy_set_header Connection "";
#         proxy_buffering off;
#         proxy_cache off;
#         proxy_read_timeout 3600s;
#     }
# }