# Copyright © 2025-26 l5yth & contributors
# Licensed under the Apache License, Version 2.0 (see LICENSE)
#
# Example nginx reverse proxy for a bare-metal PotatoMesh web deployment.
# Terminates TLS, forwards to the Puma app, and serves /assets/ straight from
# disk with SPEC AV4-aligned cache headers. Copy the relevant blocks into your
# nginx config, replace every <PLACEHOLDER>, then `nginx -t && systemctl reload nginx`.
#
# DOCKER NOTE: the container image bakes assets into /app/public with no host
# volume, so the `location /assets/` disk-serving block below does NOT apply to
# the Compose/GHCR deployment. There, get immutable asset caching from the app
# itself (see https://github.com/l5yth/potato-mesh/issues/870) or bind-mount
# web/public into an nginx sidecar. The TLS + proxy parts apply to any deployment.

# ---------------------------------------------------------------------------
# http { } context — place alongside your other http-level directives
# ---------------------------------------------------------------------------

# Persistent connections to the app so each request doesn't reopen a TCP socket.
# Requires `proxy_http_version 1.1` + `proxy_set_header Connection ""` below.
upstream potatomesh {
    server 127.0.0.1:41447;   # <APP_HOST:PORT> — match the app's PORT / -p flag
    keepalive 32;
}

# Silences the "could not build optimal types_hash" warning once gzip_types grows.
types_hash_max_size 2048;

# Optional: rate-limit requests from other PotatoMesh instances. Peers send
# `User-Agent: PotatoMesh/<version> (+https://<domain>)` and back off on 429.
# To enable, uncomment the map, limit_req_zone and limit_req_status lines here
# and the limit_req line in `location /` below. Requests with any other
# User-Agent are not limited.
# map $http_user_agent $potatomesh_peer {
#     default        "";
#     ~^PotatoMesh/  $binary_remote_addr;
# }
# limit_req_zone $potatomesh_peer zone=potatomesh_peers:1m rate=30r/m;
# limit_req_status 429;

# Optional: rate-limit reads per client address: API requests the response
# cache does not answer (any `since` or `before`, or a collection `limit` other
# than 10, 200 or 1000) and /api/telemetry/aggregated. An open dashboard sends
# up to 8 of these a second on a busy mesh, and visitors behind one NAT (camps,
# venues) share one address: set `rate` to 8r/s per such visitor. To enable,
# uncomment the map and the limit_req_zone lines here, the limit_req_status
# line above (once, for either limit or both) and the second limit_req line in
# `location /`.
# map "$uri?$args" $potatomesh_read {
#     default                         "";
#     ~^/api/telemetry/aggregated[?]  $binary_remote_addr;
#     "~*^/api/.*[?&]((s|%73)(i|%69)(n|%6e)(c|%63)(e|%65)|(b|%62)(e|%65)(f|%66)(o|%6f)(r|%72)(e|%65))="  $binary_remote_addr;
#     "~*^/api/(nodes|positions|telemetry|neighbors|traces|ingestors|waypoints|messages)/?[?](.*&)?(l|%6c)(i|%69)(m|%6d)(i|%69)(t|%74)=(?!(10|200|1000)(&|$))"  $binary_remote_addr;
# }
# limit_req_zone $potatomesh_read zone=potatomesh_reads:10m rate=40r/s;

# ---------------------------------------------------------------------------
# server { } context
# ---------------------------------------------------------------------------
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;

    server_name <mesh.example.org>;
    client_max_body_size 50m;

    # --- TLS (Certbot-managed example) -------------------------------------
    # Certbot's options-ssl-nginx.conf sets `ssl_session_tickets off` (forward
    # secrecy) and its own ssl_session_cache. Do NOT add `ssl_session_tickets on;`
    # in this block — the include already sets it, and a second one is a fatal
    # duplicate-directive error. Leaving tickets off means TLS 1.3 can't resume
    # (~1 RTT on cold connections); only enable it with rotated
    # ssl_session_ticket_key files if that RTT genuinely matters to you.
    ssl_certificate     /etc/letsencrypt/live/<mesh.example.org>/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/<mesh.example.org>/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # --- Static assets straight from disk (bare-metal only — see DOCKER NOTE) --
    # Versioned JS/CSS carry ?v=<APP_VERSION> and the whole module graph is
    # remapped via <script type="importmap"> (SPEC AV2–AV4), so they are safe to
    # cache immutably for a year. Images/icons/fonts are NOT versioned, so they
    # keep a short TTL + revalidation (AV4: a stale logo is cosmetic).
    #
    # The nginx worker user (http / www-data) must be able to traverse to and
    # read this directory. Verify with:
    #   namei -l <root>/assets/styles/base.css   # every parent needs o+x
    location /assets/ {
        root        /opt/potato-mesh/web/public;   # <path to web/public>; /assets/x → <root>/assets/x
        access_log  off;
        gzip        on;
        gzip_vary   on;
        gzip_comp_level 5;
        gzip_types  text/css text/javascript application/javascript image/svg+xml;
        # Optional: precompress *.js/*.css at release time and add `gzip_static on;`
        # for max compression at zero per-request CPU.

        # Versioned executable/style assets → immutable for a year.
        location ~* \.(?:js|mjs|css)$ {
            add_header Cache-Control "public, max-age=31536000, immutable";
            add_header Access-Control-Allow-Origin "*" always;   # add_header is not inherited into nested locations
        }
        # Unversioned images/icons/fonts → short TTL, always revalidate.
        location ~* \.(?:png|svg|ico|jpe?g|gif|webp|woff2?)$ {
            add_header Cache-Control "public, max-age=3600, must-revalidate";
            add_header Access-Control-Allow-Origin "*" always;
        }
    }

    # --- Everything else → the Puma app ------------------------------------
    location / {
        # Optional peer rate limit, see the map near the top of this file.
        # limit_req zone=potatomesh_peers burst=20 nodelay;
        # Optional read rate limit, see the second map near the top of this file.
        # limit_req zone=potatomesh_reads burst=2400 nodelay;

        proxy_pass         http://potatomesh;
        proxy_http_version 1.1;           # required for upstream keepalive
        proxy_set_header   Connection "";  # clear hop-by-hop header so sockets are reused

        # The app derives its public scheme/host (INSTANCE_DOMAIN, metadata,
        # sitemap, federation links) from these — set them or vanity/OpenGraph
        # URLs resolve to the wrong scheme/host.
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   Forwarded         "";  # drop a client's own Forwarded: it outranks X-Forwarded-Proto

        # Live-update SSE (GET /api/events) holds a long-lived streaming response.
        proxy_read_timeout 3600;
        proxy_send_timeout 3600;
    }
}

# --- Redirect plain HTTP to HTTPS ------------------------------------------
server {
    listen 80;
    listen [::]:80;
    server_name <mesh.example.org>;
    return 301 https://$host$request_uri;
}