# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    http2 on;
    server_name _;

    # TLS / SSL Configuration
    ssl_certificate /etc/nginx/certs/tls.crt;
    ssl_certificate_key /etc/nginx/certs/tls.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;

    # Security Headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Embedded Docker DNS Resolver for dynamic container discovery
    # 127.0.0.11 is Docker's internal DNS server
    resolver 127.0.0.11 valid=5s ipv6=off;
    resolver_timeout 5s;

    # Health check endpoint
    location = /healthz {
        access_log off;
        default_type text/plain;
        return 200 "OK\n";
    }

    # --------------------------------------------------------------------------
    # 1. Backend Core Management API (Auth, OTP, Session Lifecycle)
    # --------------------------------------------------------------------------
    location /api/ {
        set $backend_upstream "backend:8000";
        proxy_pass http://$backend_upstream;
        include /etc/nginx/includes/proxy_headers.conf;
        include /etc/nginx/includes/websocket_params.conf;
    }

    # --------------------------------------------------------------------------
    # 2. Dynamic Artemis Session Containers: Real-time Trace & Event Stream (SSE/WS)
    # Target container: artemis-session-<session_id>:8080
    # --------------------------------------------------------------------------
    location ~ ^/session/(?<session_id>[a-zA-Z0-9_-]+)/artemis/stream/(?<stream_path>.*)$ {
        set $artemis_host "artemis-session-$session_id";
        proxy_pass http://$artemis_host:8080/stream/$stream_path$is_args$args;
        include /etc/nginx/includes/sse_params.conf;
        include /etc/nginx/includes/websocket_params.conf;
    }

    # --------------------------------------------------------------------------
    # 3. Dynamic Artemis Session Containers: REST APIs & Admin Console
    # Target container: artemis-session-<session_id>:8080
    # --------------------------------------------------------------------------
    location ~ ^/session/(?<session_id>[a-zA-Z0-9_-]+)/artemis/(?<artemis_path>.*)$ {
        set $artemis_host "artemis-session-$session_id";
        proxy_pass http://$artemis_host:8080/$artemis_path$is_args$args;
        include /etc/nginx/includes/proxy_headers.conf;
        include /etc/nginx/includes/websocket_params.conf;
    }

    # --------------------------------------------------------------------------
    # 4. Cuttlefish Emulator WebRTC Signaling & Stream Proxy
    # Proxies signaling requests to the Cloud Orchestrator / CVD daemon
    # --------------------------------------------------------------------------
    location ~ ^/session/(?<session_id>[a-zA-Z0-9_-]+)/cuttlefish/(?<cf_path>.*)$ {
        # Host gateway communication or cloud-orchestrator container
        set $cuttlefish_upstream "host.docker.internal:8443";
        proxy_pass http://$cuttlefish_upstream/$cf_path$is_args$args;
        include /etc/nginx/includes/proxy_headers.conf;
        include /etc/nginx/includes/websocket_params.conf;
    }

    # --------------------------------------------------------------------------
    # 5. Static Frontend Single Page Application (Served via Backend or Static Dist)
    # --------------------------------------------------------------------------
    location / {
        set $backend_upstream "backend:8000";
        proxy_pass http://$backend_upstream;
        include /etc/nginx/includes/proxy_headers.conf;
    }

    # --------------------------------------------------------------------------
    # 6. Custom JSON Error Pages for Ephemeral Container Boot & Teardown States
    # --------------------------------------------------------------------------
    error_page 502 /502.json;
    error_page 504 /504.json;

    location = /502.json {
        root /usr/share/nginx/html;
        internal;
        default_type application/json;
    }

    location = /504.json {
        root /usr/share/nginx/html;
        internal;
        default_type application/json;
    }
}