# Configuration Nginx pour 4NK_node sur l'hôte Debian
# Reverse proxy et équilibreur de charge pour tous les services Docker

# Configuration globale
user www-data;
worker_processes auto;
error_log /var/log/nginx/4nk-node-error.log notice;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Logging spécifique à 4NK_node
    log_format 4nk_main '$remote_addr - $remote_user [$time_local] "$request" '
                        '$status $body_bytes_sent "$http_referer" '
                        '"$http_user_agent" "$http_x_forwarded_for" '
                        'upstream: $upstream_addr';

    access_log /var/log/nginx/4nk-node-access.log 4nk_main;

    # Performance
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    client_max_body_size 100M;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml+rss
        application/atom+xml
        image/svg+xml;

    # Rate limiting
    limit_req_zone $binary_remote_addr zone=4nk_api:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=4nk_login:10m rate=1r/s;

    # Upstream servers - ports Docker exposés sur l'hôte
    upstream bitcoin_rpc {
        server 127.0.0.1:38332;
        keepalive 32;
    }

    upstream bitcoin_p2p {
        server 127.0.0.1:38333;
        keepalive 32;
    }

    upstream blindbit_api {
        server 127.0.0.1:8000;
        keepalive 32;
    }

    upstream sdk_storage_api {
        server 127.0.0.1:8081;
        keepalive 32;
    }

    upstream sdk_relay1_api {
        server 127.0.0.1:8090;
        keepalive 32;
    }

    upstream sdk_relay2_api {
        server 127.0.0.1:8092;
        keepalive 32;
    }

    upstream sdk_relay3_api {
        server 127.0.0.1:8094;
        keepalive 32;
    }

    upstream sdk_signer_api {
        server 127.0.0.1:9090;
        keepalive 32;
    }

    upstream ihm_client_web {
        server 127.0.0.1:3003;
        keepalive 32;
    }

    upstream ihm_client_http {
        server 127.0.0.1:8080;
        keepalive 32;
    }

    upstream grafana_dashboard {
        server 127.0.0.1:3000;
        keepalive 32;
    }

    upstream loki_api {
        server 127.0.0.1:3100;
        keepalive 32;
    }

    # Le coffre services (backend/frontend)
    upstream coffre_backend {
        server 127.0.0.1:8082;
        keepalive 32;
    }
    upstream coffre_front {
        server 127.0.0.1:8083;
        keepalive 32;
    }

    # Main server block
    server {
        listen 80;
        server_name 4nk-node.local localhost;

        # Security headers
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer-when-downgrade" always;
        add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

        # Health check endpoint
        location /health {
            access_log off;
            return 200 "4NK Node healthy\n";
            add_header Content-Type text/plain;
        }

        # Bitcoin RPC (JSON-RPC)
        location /bitcoin/rpc/ {
            limit_req zone=4nk_api burst=20 nodelay;

            proxy_pass http://bitcoin_rpc/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Bitcoin RPC specific
            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
        }

        # Bitcoin P2P (port 38333)
        location /bitcoin/p2p/ {
            proxy_pass http://bitcoin_p2p/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # BlindBit API
        location /blindbit/ {
            limit_req zone=4nk_api burst=20 nodelay;

            proxy_pass http://blindbit_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_connect_timeout 30s;
            proxy_send_timeout 30s;
            proxy_read_timeout 30s;
        }

        # SDK Storage API
        location /storage/ {
            limit_req zone=4nk_api burst=20 nodelay;

            proxy_pass http://sdk_storage_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # SDK Relay APIs
        location /relay1/ {
            limit_req zone=4nk_api burst=20 nodelay;
            proxy_pass http://sdk_relay1_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        location /relay2/ {
            limit_req zone=4nk_api burst=20 nodelay;
            proxy_pass http://sdk_relay2_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        location /relay3/ {
            limit_req zone=4nk_api burst=20 nodelay;
            proxy_pass http://sdk_relay3_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # SDK Signer API
        location /signer/ {
            limit_req zone=4nk_api burst=20 nodelay;
            proxy_pass http://sdk_signer_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # IHM Client Web (React)
        location /ihm/ {
            proxy_pass http://ihm_client_web/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # WebSocket support
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # IHM Client HTTP
        location /ihm-http/ {
            proxy_pass http://ihm_client_http/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Grafana Dashboard
        location /grafana/ {
            proxy_pass http://grafana_dashboard/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Grafana specific
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # Loki API (logs)
        location /loki/ {
            limit_req zone=4nk_api burst=20 nodelay;
            proxy_pass http://loki_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Default route - IHM Client
        location / {
            proxy_pass http://ihm_client_web/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # WebSocket support
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # Error pages
        error_page 404 /404.html;
        error_page 500 502 503 504 /50x.html;

        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }

    # HTTPS server (commented out - uncomment and configure SSL for production)
    # server {
    #     listen 443 ssl http2;
    #     server_name 4nk-node.local;
    #
    #     ssl_certificate /etc/ssl/certs/4nk-node.crt;
    #     ssl_certificate_key /etc/ssl/private/4nk-node.key;
    #     ssl_protocols TLSv1.2 TLSv1.3;
    #     ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
    #     ssl_prefer_server_ciphers off;
    #
    #     # Same location blocks as HTTP server
    #     # ... (copy from above)
    # }
}