# Vida Chart — Standalone Nginx reverse proxy config
# ⚠️  FOR NON-cPANEL SERVERS ONLY.
# On the cPanel/WHM + EA-Nginx box (chart.vidanexus.ai), do NOT use this file —
# use the Apache vhost includes in deploy/cpanel/ instead (EA-Nginx + AutoSSL
# generate the server block and cert for you).
#
# Replace chart.vidanexus.ai with your domain.
# Requires: SSL certificates at /etc/letsencrypt/live/chart.vidanexus.ai/fullchain.pem + key.pem (e.g. certbot).

upstream vida_backend {
    server 127.0.0.1:3000;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name chart.vidanexus.ai;

    ssl_certificate     /etc/letsencrypt/live/chart.vidanexus.ai/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/chart.vidanexus.ai/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;

    # Security headers (supplements Helmet in the app)
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Gzip compression for text responses
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json text/javascript application/javascript
               text/xml application/xml application/xml+rss text/event-stream;

    # ── tracker.js — public, cache 1 hour ──────────────────────────────────
    location = /tracker.js {
        proxy_pass http://vida_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        add_header Cache-Control "public, max-age=3600, stale-while-revalidate=86400";
        add_header Access-Control-Allow-Origin "*";
    }

    # ── /api/collect — beacon endpoint, allow any origin ──────────────────
    location = /api/collect {
        proxy_pass http://vida_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        # Fast: don't buffer collect responses (they're always 204)
        proxy_buffering off;
        client_max_body_size 16k;
    }

    # ── SSE stream — disable buffering to prevent stalls ──────────────────
    location /api/stream/ {
        proxy_pass http://vida_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection '';          # keep-alive for SSE
        proxy_buffering off;
        proxy_cache off;
        gzip off;
        proxy_read_timeout 3600s;               # 1-hour timeout for long-lived SSE
        chunked_transfer_encoding on;
    }

    # ── API routes ─────────────────────────────────────────────────────────
    location /api/ {
        proxy_pass http://vida_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";
        proxy_read_timeout 30s;
        client_max_body_size 10m;   # allow service account JSON uploads
    }

    # ── Static dashboard files ─────────────────────────────────────────────
    location / {
        proxy_pass http://vida_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        # Short cache for HTML; static assets (CSS/JS) get longer cache from Express
        proxy_cache_valid 200 5m;
    }
}

# ── HTTP → HTTPS redirect ──────────────────────────────────────────────────────
server {
    listen 80;
    server_name chart.vidanexus.ai;
    return 301 https://$server_name$request_uri;
}