# Nginx configuration for Soil Water Balance Model API
# Place this file in /etc/nginx/sites-available/ and create symlink to sites-enabled/

upstream soil_water_api {
    server 127.0.0.1:8000;
    # Add more servers for load balancing if needed
    # server 127.0.0.1:8001;
    # server 127.0.0.1:8002;
}

server {
    listen 80;
    server_name your-domain.com;  # Replace with your actual domain

    # Redirect HTTP to HTTPS (optional, but recommended)
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name your-domain.com;  # Replace with your actual domain

    # SSL configuration (replace with your actual certificates)
    ssl_certificate /path/to/your/certificate.crt;
    ssl_certificate_key /path/to/your/private.key;

    # SSL security settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    # API endpoints
    location / {
        proxy_pass http://soil_water_api;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Timeout settings
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;

        # File upload size limit (adjust as needed)
        client_max_body_size 50M;
    }

    # Health check endpoint (for load balancer)
    location /health {
        proxy_pass http://soil_water_api/health;
        access_log off;
    }

    # API documentation
    location /docs {
        proxy_pass http://soil_water_api/docs;
        proxy_set_header Host $host;
    }

    # Static files for API docs
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        proxy_pass http://soil_water_api;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}