# ------------------------------------------------------------------------------
# HTTPS Server Block (TLS Termination)
# ------------------------------------------------------------------------------
server {
    listen 443 ssl;
    server_name         your.domain.tld;
    ssl_certificate     path;
    ssl_certificate_key path;

    # --------------------------------------------------------------------------
    # Security Headers
    # --------------------------------------------------------------------------
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # --------------------------------------------------------------------------
    # Proxy to Frontend Container (everything goes through it)
    # --------------------------------------------------------------------------
    location / {
        # Forward all traffic to the frontend container
        proxy_pass http://127.0.0.1:5173;   # <-- Frontend host port (adjust if needed)
        proxy_http_version 1.1;

        # Headers for correct client IP and protocol forwarding
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # The frontend container handles WebSocket upgrades internally,
        # but we still need to pass the upgrade headers through.
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # Increase timeouts for long-running operations
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;

        # Allow large file uploads (matches client_max_body_size in frontend NGINX)
        client_max_body_size 500M;
    }
}