worker_processes 1;
error_log /var/log/nginx/error.log warn;

events {
    worker_connections 768;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    access_log /var/log/nginx/access.log;
    sendfile on;
    keepalive_timeout 65;
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # Allow large uploads globally (filebrowser, etc.)
    client_max_body_size 0;

    # WebSocket upgrade passthrough (mempool live data, etc.)
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    server {
        listen 80 default_server;
        server_name _;
        root /usr/share/nginx/html;
        index index.html index.htm;

        # Proxy API requests to backend
        location /rpc/v1 {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Proxy WebSocket connections
        location /ws {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 86400;
        }

        # Proxy public assets from backend
        location /public {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Proxy REST API requests
        location /rest {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # ElectrumX UI status (polled by the electrs-ui shell)
        location /electrs-status {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # LND UI endpoints (polled by the lnd-ui shell)
        location /proxy/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
        location /lnd-connect-info {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Proxy FileBrowser API to mock backend (demo mode)
        # ^~ on every /app/ prefix: the .css/.js/.img cache regex below must
        # never swallow app-shell assets (they live on the backend, not in the
        # web root — without ^~ nginx prefers the regex and 404s them).
        location ^~ /app/filebrowser/ {
            client_max_body_size 10G;
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_request_buffering off;
        }

        # IndeeHub is no longer proxied same-origin — the sub_filter rewrite
        # approach broke the SPA's runtime-built asset URLs. The demo now opens
        # the real site (https://indee.tx1138.com/) externally instead, via
        # DEMO_EXTERNAL_URLS in useDemoIntro.ts.

        # Mempool is NOT proxied upstream anymore — the mock backend serves a
        # branded placeholder page for it (see DEMO_APP_PAGES in mock-backend.js),
        # so /app/mempool/ falls through to the generic /app/ location below.

        # Proxy every other app UI (/app/<id>/) to the mock backend, which serves
        # the per-app mock UIs (bitcoin-ui, electrumx, lnd, fedimint) and the
        # generic "Not available in the demo" notice for the rest.
        location ^~ /app/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Serve AIUI SPA
        location /aiui/ {
            alias /usr/share/nginx/html/aiui/;
            try_files $uri $uri/ =404;

            location ~* /aiui/assets/ {
                expires 1y;
                add_header Cache-Control "public, immutable";
            }
        }

        # Proxy AIUI API requests (web-search, etc.) to backend
        location /api/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # Proxy Ollama (local AI) requests to backend
        location /aiui/api/ollama/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_buffering off;
            proxy_cache off;
            proxy_read_timeout 300s;
            proxy_set_header Connection "";
        }

        # Proxy Claude API requests to backend (which handles API key + streaming)
        location /aiui/api/claude/ {
            proxy_pass http://neode-backend:5959;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_buffering off;
            proxy_cache off;
            proxy_read_timeout 300s;
            proxy_set_header Connection "";
        }

        # Serve static files
        location / {
            try_files $uri $uri/ /index.html;
        }

        # Cache static assets (media too — the intro video/audio are versioned
        # with ?v=N query busters, so immutable is safe)
        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|webp|mp4|webm|mp3|woff2?)$ {
            expires 1y;
            add_header Cache-Control "public, immutable";
        }
    }
}