# Reverse proxy for the three ciagent.org subdomains, sitting between
# Cloudflare (which terminates public-facing TLS and hides this origin's
# real IP) and the app's own containers. TLS here is a Cloudflare Origin CA
# certificate (Cloudflare dashboard -> SSL/TLS -> Origin Server -> Create
# Certificate; covers ciagent.org + *.ciagent.org, up to 15yr validity, only
# trusted by Cloudflare - no ACME/renewal machinery needed). Cloudflare SSL
# mode must be "Full (strict)" for this to be meaningful. See DEPLOYMENT.md.
#
# CF-Connecting-IP (the header app.core.security.get_client_ip reads once
# TRUSTED_PROXY_IP_HEADER=CF-Connecting-IP is set) needs no special handling
# here - Nginx forwards any header it doesn't explicitly touch straight
# through to the upstream unmodified.

user nginx;
worker_processes auto;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    server_tokens off;

    # Bare :80 hits get redirected to :443 - Cloudflare already enforces
    # HTTPS at the edge, but the origin shouldn't 400 a direct :80 probe.
    server {
        listen 80;
        server_name ciagent.org api.ciagent.org git.ciagent.org;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name ciagent.org;

        ssl_certificate     /etc/nginx/certs/cloudflare-origin.pem;
        ssl_certificate_key /etc/nginx/certs/cloudflare-origin.key;

        location / {
            proxy_pass http://web:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }

    server {
        listen 443 ssl;
        server_name api.ciagent.org;

        ssl_certificate     /etc/nginx/certs/cloudflare-origin.pem;
        ssl_certificate_key /etc/nginx/certs/cloudflare-origin.key;

        location / {
            proxy_pass http://api:8000;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }

    server {
        listen 443 ssl;
        server_name git.ciagent.org;

        ssl_certificate     /etc/nginx/certs/cloudflare-origin.pem;
        ssl_certificate_key /etc/nginx/certs/cloudflare-origin.key;

        # Large git pushes (Gitea's HTTPS push path).
        client_max_body_size 512m;

        location / {
            proxy_pass http://gitea:3000;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }
}