server_tokens off;
charset utf-8;

# Backend (Django gunicorn) service inside the cluster.
upstream airshelf_api {
    server airshelf-core-api:8000;
}

# Preserve the original scheme: traefik terminates TLS and forwards
# X-Forwarded-Proto=https; fall back to our own scheme if it's absent.
map $http_x_forwarded_proto $fwd_proto {
    default $http_x_forwarded_proto;
    ""      $scheme;
}

server {
    listen 80;
    server_name _;
    root /usr/share/nginx/html;
    index index.html;

    # 上传视频提炼允许 200MB(见 video_digest.MAX_UPLOAD_BYTES)。multipart 还有表单开销,
    # 给到 220m。以前 50m 会在进 Django 前直接 413,手机拍的参考片很容易超。
    client_max_body_size 220m;
    client_body_timeout 300s;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # ---- Backend pass-through (same origin, no CORS) ----
    location /api/ {
        proxy_pass http://airshelf_api;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $fwd_proto;
        # web 容器只有 128Mi,不要把整段视频缓存在 nginx 里再转发。
        proxy_request_buffering off;
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
        proxy_connect_timeout 60s;
    }

    # Django 自带后台(已从 /admin/ 挪到 /django-admin/);/admin/* 留给前端 SPA 平台后台,走底部 try_files 回落 index.html
    location /django-admin/ {
        proxy_pass http://airshelf_api;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $fwd_proto;
    }

    # Django/WhiteNoise admin static assets
    location /static/ {
        proxy_pass http://airshelf_api;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $fwd_proto;
    }

    # ---- Frontend SPA: hashed assets cache long, index.html never ----
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    location = /index.html {
        add_header Cache-Control "no-cache, must-revalidate" always;
        expires off;
    }

    # SPA fallback: every unknown path serves index.html (client-side routing)
    location / {
        try_files $uri $uri/ /index.html;
    }
}