# Nginx configuration for omni-node (192.168.1.160)
# Proxies requests to ceph2401 (192.168.1.161:8000)
#
# Installation:
# 1. Copy to omni-node: sudo cp nginx-translynx.conf /etc/nginx/sites-available/translynx
# 2. Enable: sudo ln -s /etc/nginx/sites-available/translynx /etc/nginx/sites-enabled/
# 3. Test: sudo nginx -t
# 4. Reload: sudo systemctl reload nginx

upstream translynx_backend {
    server 192.168.1.161:8000;  # ceph2401
}

# HTTP server (redirect to HTTPS in production)
server {
    listen 80;
    server_name translynx.ai www.translynx.ai;

    # For development, allow HTTP
    # In production, uncomment this to force HTTPS:
    # return 301 https://$server_name$request_uri;

    # API endpoints
    location /api/ {
        proxy_pass http://translynx_backend;
        proxy_http_version 1.1;

        # Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support (for future use)
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        # CORS (handled by FastAPI, but can add here too)
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Authorization, Content-Type" always;

        if ($request_method = 'OPTIONS') {
            return 204;
        }
    }

    # API docs
    location /docs {
        proxy_pass http://translynx_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /redoc {
        proxy_pass http://translynx_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /openapi.json {
        proxy_pass http://translynx_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # Health check
    location /health {
        proxy_pass http://translynx_backend;
        proxy_set_header Host $host;
        access_log off;
    }

    # Root redirect to docs (for testing)
    location = / {
        return 302 /docs;
    }

    # Error pages
    error_page 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }
}

# HTTPS server (for production with SSL certificate)
# Uncomment when you have SSL certificate
# server {
#     listen 443 ssl http2;
#     server_name translynx.ai www.translynx.ai;
#
#     ssl_certificate /etc/letsencrypt/live/translynx.ai/fullchain.pem;
#     ssl_certificate_key /etc/letsencrypt/live/translynx.ai/privkey.pem;
#     ssl_protocols TLSv1.2 TLSv1.3;
#     ssl_ciphers HIGH:!aNULL:!MD5;
#
#     # Same locations as HTTP above...
#     location /api/ {
#         proxy_pass http://translynx_backend;
#         # ... (same config as above)
#     }
# }
