events {}

http {
    # Docker's embedded DNS: resolve service names per request (cached 10s).
    # nginx would otherwise resolve them once at startup and keep proxying to
    # a recreated container's old IP — a 502 until nginx itself is reloaded.
    resolver 127.0.0.11 valid=10s ipv6=off;

    server {
        listen 80;
        server_name _;

        # The Lean editor server, at the site's own https origin instead of a
        # bare :8080 (NUXT_PUBLIC_LEAN_URL points here). Longest-prefix wins,
        # so this beats /api below. lean4web serves from its root, so the
        # /api/lean prefix is stripped before proxying: the wiki's client asks
        # for /api/lean/websocket/<project> and /api/lean/api/projects.
        location = /api/lean {
            # relative Location: the outer TLS proxy's scheme/host stay the
            # browser's (an absolute redirect would say http://)
            absolute_redirect off;
            return 301 /api/lean/;
        }

        location /api/lean/ {
            set $lean_upstream lean:8080;
            # `break` ends the rewrite phase, so the variable above is set first
            rewrite ^/api/lean/(.*)$ /$1 break;
            proxy_pass http://$lean_upstream;

            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            # A Lean session can sit idle while the reader thinks; the 60s
            # default would drop its websocket.
            proxy_read_timeout 1h;
            proxy_send_timeout 1h;
        }

        # Api Requests ("/api" without a trailing slash must land here too,
        # or it falls through to the frontend and loops through its SSR proxy)
        location /api {
            set $api_upstream backend:5000;
            proxy_pass http://$api_upstream;

            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # Normal requests
        location / {
            set $frontend_upstream frontend:3000;
            proxy_pass http://$frontend_upstream;

            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

    }
}