# ═══════════════════════════════════════════════════════════
# Awen 域名反向代理配置 · 新加坡中转
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-NGX-AWEN
# 中转服务器: ZY-SVR-002 (43.134.16.246 · 新加坡)
# 后端服务器: ZY-SVR-AWEN (广州 · Awen实际服务)
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
#
# 架构:
#   用户浏览器 → Awen域名(DNS→新加坡IP)
#     → ZY-SVR-002 Nginx(本配置·反向代理)
#     → Awen广州服务器(实际服务)
#
# 域名未备案解决方案:
#   域名DNS A记录指向新加坡IP → 无需中国大陆ICP备案
#   新加坡Nginx将请求反向代理到广州后端
#   延迟约30-50ms · 对Web应用可接受
#
# 占位符由 deploy workflow 自动替换:
#   AWEN_DOMAIN_PLACEHOLDER      ← GitHub Secret: AWEN_DOMAIN
#   AWEN_BACKEND_HOST_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_HOST
#   AWEN_BACKEND_PORT_PLACEHOLDER ← GitHub Secret: AWEN_BACKEND_PORT
# ═══════════════════════════════════════════════════════════

# ─── Awen 域名 · 反向代理到广州后端 ───
server {
    listen 80;
    server_name AWEN_DOMAIN_PLACEHOLDER;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Server-Identity "ZY-SVR-002" always;
    add_header X-Proxy-Mode "awen-reverse-proxy" always;

    # ─── 请求体大小限制 (允许文件上传) ───
    client_max_body_size 50m;

    # ─── 主路由 · 反向代理到广州后端 ───
    location / {
        proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER;
        proxy_http_version 1.1;

        # ─── 请求头透传 ───
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;

        # ─── WebSocket 支持 ───
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # ─── 超时设置 (跨境延迟考虑 · 新加坡↔广州) ───
        proxy_connect_timeout 15s;
        proxy_read_timeout 120s;
        proxy_send_timeout 60s;

        # ─── 缓冲设置 ───
        proxy_buffering on;
        proxy_buffer_size 16k;
        proxy_buffers 4 32k;
        proxy_busy_buffers_size 64k;

        # ─── 错误处理 · 后端不可达时返回友好页面 ───
        proxy_intercept_errors on;
        error_page 502 503 504 /awen_backend_unavailable.html;
    }

    # ─── 健康检查端点 (不记录日志 · 减少噪音) ───
    location = /health {
        proxy_pass http://AWEN_BACKEND_HOST_PLACEHOLDER:AWEN_BACKEND_PORT_PLACEHOLDER/health;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_connect_timeout 5s;
        proxy_read_timeout 10s;
        access_log off;
    }

    # ─── Let's Encrypt 证书验证路径 ───
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
        allow all;
    }

    # ─── 后端不可达时的友好错误页 ───
    location = /awen_backend_unavailable.html {
        internal;
        default_type text/html;
        return 502 '<!DOCTYPE html><html><head><meta charset="utf-8"><title>Service Temporarily Unavailable</title><style>body{font-family:sans-serif;text-align:center;padding:80px 20px;background:#f7f7f7}h1{color:#333}p{color:#666}</style></head><body><h1>503 Service Temporarily Unavailable</h1><p>The backend server is currently unreachable. Please try again later.</p><p style="font-size:12px;color:#999">Proxy: ZY-SVR-002 (Singapore) → Backend: Guangzhou</p></body></html>';
    }

    # ─── 访问日志 · 独立文件便于监控 ───
    access_log /opt/zhuyuan/data/logs/nginx-awen-proxy.log;
    error_log /opt/zhuyuan/data/logs/nginx-awen-proxy-error.log;
}

# ─── WebSocket 升级映射 ───
# 注意: 此 map 块必须位于 http {} 上下文 (不在 server {} 内)
# 如果 nginx.conf 或其他配置文件已定义 $connection_upgrade，
# 部署 workflow 会自动检测并移除本段避免冲突
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}
