# Musify edge. The nginx entrypoint renders this with envsubst into
# /etc/nginx/conf.d/default.conf (replacing the image's stock file) using the
# MUSIFY_* variables set in compose.prod.yml.
#
# Cloudflare (Full strict) terminates the public edge; this box only needs to
# serve the Cloudflare Origin Certificate in nginx/certs/. Each vhost proxies to
# a compose service by name through the embedded Docker DNS resolver, so nginx
# re-resolves it instead of caching the IP of a container that may be recreated.

resolver 127.0.0.11 valid=10s;

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    server_name ${MUSIFY_ROOT_DOMAIN} www.${MUSIFY_ROOT_DOMAIN}
                api.${MUSIFY_ROOT_DOMAIN} auth.${MUSIFY_ROOT_DOMAIN}
                stream.${MUSIFY_ROOT_DOMAIN} s3.${MUSIFY_ROOT_DOMAIN};
    return 301 https://$host$request_uri;
}

# Web player (SvelteKit, adapter-node). Uploads are posted to its own form
# actions, so it needs the large body size too.
server {
    listen 443 ssl;
    http2 on;
    server_name ${MUSIFY_ROOT_DOMAIN};
    client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};

    ssl_certificate     /etc/nginx/certs/origin.pem;
    ssl_certificate_key /etc/nginx/certs/origin.key;

    location / {
        set $upstream http://web-player:3000;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
    }
}

server {
    listen 443 ssl;
    http2 on;
    server_name www.${MUSIFY_ROOT_DOMAIN};

    ssl_certificate     /etc/nginx/certs/origin.pem;
    ssl_certificate_key /etc/nginx/certs/origin.key;

    return 301 https://${MUSIFY_ROOT_DOMAIN}$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name api.${MUSIFY_ROOT_DOMAIN};

    ssl_certificate     /etc/nginx/certs/origin.pem;
    ssl_certificate_key /etc/nginx/certs/origin.key;

    location / {
        set $upstream http://api:5111;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
    }
}

# Audio bytes. Buffering off keeps range requests (seeking) responsive.
server {
    listen 443 ssl;
    http2 on;
    server_name stream.${MUSIFY_ROOT_DOMAIN};

    ssl_certificate     /etc/nginx/certs/origin.pem;
    ssl_certificate_key /etc/nginx/certs/origin.key;

    location / {
        set $upstream http://gateway:8081;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
        proxy_buffering off;
    }
}

server {
    listen 443 ssl;
    http2 on;
    server_name auth.${MUSIFY_ROOT_DOMAIN};

    ssl_certificate     /etc/nginx/certs/origin.pem;
    ssl_certificate_key /etc/nginx/certs/origin.key;

    location / {
        set $upstream http://zitadel:8080;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
        grpc_set_header Host $host;
    }
}

# Presigned S3 PUT/GET straight from the browser.
server {
    listen 443 ssl;
    http2 on;
    server_name s3.${MUSIFY_ROOT_DOMAIN};
    client_max_body_size ${MUSIFY_MAX_UPLOAD_SIZE};

    ssl_certificate     /etc/nginx/certs/origin.pem;
    ssl_certificate_key /etc/nginx/certs/origin.key;

    location / {
        set $upstream http://seaweedfs:8333;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
        proxy_request_buffering off;
    }
}