worker_processes 1;
error_log /var/log/nginx/error.log warn;

events {
    worker_connections 768;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    access_log /var/log/nginx/access.log;
    sendfile on;
    keepalive_timeout 65;
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # Allow large uploads globally (filebrowser, etc.)
    client_max_body_size 0;

    # WebSocket upgrade passthrough (mempool live data, etc.)
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    server {
        listen 80 default_server;
        server_name _;
        root /usr/share/nginx/html;
        index index.html index.htm;

        # Proxy API requests to backend
        location /rpc/v1 {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Proxy WebSocket connections
        location /ws {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 86400;
        }

        # Proxy public assets from backend
        location /public {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Proxy REST API requests
        location /rest {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # ElectrumX UI status (polled by the electrs-ui shell)
        location /electrs-status {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # LND UI endpoints (polled by the lnd-ui shell)
        location /proxy/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
        location /lnd-connect-info {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Proxy FileBrowser API to mock backend (demo mode)
        # ^~ on every /app/ prefix: the .css/.js/.img cache regex below must
        # never swallow app-shell assets (they live on the backend, not in the
        # web root — without ^~ nginx prefers the regex and 404s them).
        location ^~ /app/filebrowser/ {
            client_max_body_size 10G;
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_request_buffering off;
        }

        # IndeeHub is NOT proxied under a /app/indeedhub/ path prefix — the
        # old sub_filter path-rewrite approach broke the SPA's runtime-built
        # absolute-root asset URLs. Instead, a dedicated WHOLE-ORIGIN reverse
        # proxy of https://indee.tx1138.com listens on :2101 (see the second
        # server block below): the SPA sees itself at '/' so every asset and
        # router path just works, framing headers are stripped, and a demo
        # sign-in seed script is injected. useDemoIntro.demoAppUrl points the
        # in-app iframe at http://<demo-host>:2101/.

        # Mempool is NOT proxied upstream anymore — the mock backend serves a
        # branded placeholder page for it (see DEMO_APP_PAGES in mock-backend.js),
        # so /app/mempool/ falls through to the generic /app/ location below.

        # Proxy every other app UI (/app/<id>/) to the mock backend, which serves
        # the per-app mock UIs (bitcoin-ui, electrumx, lnd, fedimint) and the
        # generic "Not available in the demo" notice for the rest.
        location ^~ /app/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Serve AIUI SPA
        location /aiui/ {
            alias /usr/share/nginx/html/aiui/;
            try_files $uri $uri/ =404;

            location ~* /aiui/assets/ {
                expires 1y;
                add_header Cache-Control "public, immutable";
            }
        }

        # Proxy AIUI API requests (web-search, etc.) to backend
        location /api/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Proxy Ollama (local AI) requests to backend
        location /aiui/api/ollama/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_buffering off;
            proxy_cache off;
            proxy_read_timeout 300s;
            proxy_set_header Connection "";
        }

        # Proxy Claude API requests to backend (which handles API key + streaming)
        location /aiui/api/claude/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_buffering off;
            proxy_cache off;
            proxy_read_timeout 300s;
            proxy_set_header Connection "";
        }

        # Serve static files
        location / {
            try_files $uri $uri/ /index.html;
        }

        # Cache static assets (media too — the intro video/audio are versioned
        # with ?v=N query busters, so immutable is safe)
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|webp|mp4|webm|mp3|woff2?)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
    }

    # ── IndeeHub whole-origin demo proxy (:2101) ────────────────────────────
    # Pure reverse proxy of the LIVE https://indee.tx1138.com site on its own
    # port — no path prefix, no URL rewriting, so the SPA's absolute-root
    # asset/router paths work untouched. The upstream's X-Frame-Options
    # (SAMEORIGIN) and any CSP are stripped so the demo can embed it in the
    # in-app iframe session, and a PUBLIC-DEMO-ONLY sign-in seed script is
    # injected into the HTML <head> (it seeds a labelled throwaway demo Nostr
    # account into the :2101 origin's isolated localStorage, so IndeeHub boots
    # signed in). Upstream is pinned to a single fixed hostname — this cannot
    # be used as an open proxy.
    server {
        listen 2101;
        server_name _;

        # Demo sign-in seeder, served same-origin to the proxied SPA.
        location = /__demo/indee-demo-signin.js {
            root /usr/share/nginx/html;
            add_header Cache-Control "no-store";
        }

        location / {
            proxy_pass https://indee.tx1138.com;
            proxy_ssl_server_name on;
            proxy_ssl_name indee.tx1138.com;
            proxy_set_header Host indee.tx1138.com;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 86400;

            # Allow embedding in the demo's iframe session.
            proxy_hide_header X-Frame-Options;
            proxy_hide_header Content-Security-Policy;

            # HTML injection: upstream must not compress or sub_filter no-ops.
            # (sub_filter applies to text/html by default — exactly what we want.)
            proxy_set_header Accept-Encoding "";
            sub_filter_once on;
            sub_filter '</head>' '<script src="/__demo/indee-demo-signin.js"></script></head>';
        }
    }
}