# =============================================================================
# Configuración del sitio - App Padel API
# Fase 7.4 - Go Live y Soporte
# =============================================================================

# Redirección HTTP a HTTPS
server {
    listen 80;
    server_name _;
    
    # Health check para load balancers
    location /health {
        access_log off;
        return 200 "healthy\n";
        add_header Content-Type text/plain;
    }
    
    # Redirigir todo a HTTPS (en producción con SSL)
    # location / {
    #     return 301 https://$host$request_uri;
    # }
    
    # Sin SSL (para desarrollo/staging inicial)
    location / {
        proxy_pass http://app;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 300s;
        proxy_connect_timeout 75s;
    }
}

# Configuración HTTPS (descomentar cuando se tenga SSL)
# server {
#     listen 443 ssl http2;
#     server_name api.tudominio.com;
#     
#     # Certificados SSL
#     ssl_certificate /etc/nginx/ssl/cert.pem;
#     ssl_certificate_key /etc/nginx/ssl/key.pem;
#     
#     # Configuración SSL optimizada
#     ssl_protocols TLSv1.2 TLSv1.3;
#     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
#     ssl_prefer_server_ciphers off;
#     ssl_session_cache shared:SSL:10m;
#     ssl_session_timeout 1d;
#     ssl_session_tickets off;
#     
#     # HSTS (después de verificar que HTTPS funciona)
#     # add_header Strict-Transport-Security "max-age=63072000" always;
#     
#     # Root y archivos estáticos (opcional)
#     root /usr/share/nginx/html;
#     index index.html;
#     
#     # Archivos estáticos con cache
#     location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
#         expires 1y;
#         add_header Cache-Control "public, immutable";
#         try_files $uri =404;
#     }
#     
#     # Frontend (si se sirve desde nginx)
#     location / {
#         try_files $uri $uri/ /index.html;
#         add_header Cache-Control "no-cache";
#     }
#     
#     # API - Rate limiting
#     location /api/ {
#         limit_req zone=api burst=20 nodelay;
#         
#         proxy_pass http://app;
#         proxy_http_version 1.1;
#         proxy_set_header Upgrade $http_upgrade;
#         proxy_set_header Connection 'upgrade';
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_cache_bypass $http_upgrade;
#         proxy_read_timeout 300s;
#         proxy_connect_timeout 75s;
#         
#         # CORS headers (si no los maneja la app)
#         # add_header 'Access-Control-Allow-Origin' 'https://tudominio.com' always;
#         # add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
#         # add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
#     }
#     
#     # Login endpoint - Rate limiting más estricto
#     location /api/v1/auth/login {
#         limit_req zone=login burst=5 nodelay;
#         
#         proxy_pass http://app;
#         proxy_http_version 1.1;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#     }
#     
#     # Health check endpoint
#     location /api/v1/health {
#         access_log off;
#         proxy_pass http://app;
#         proxy_http_version 1.1;
#         proxy_set_header Host $host;
#     }
#     
#     # Monitoreo / métricas (restringir IP)
#     location /api/v1/health/metrics {
#         # allow 10.0.0.0/8;  # IPs internas
#         # deny all;
#         
#         proxy_pass http://app;
#         proxy_http_version 1.1;
#         proxy_set_header Host $host;
#     }
# }