# nginx/nginx.conf
# BiznesOutlet.pl – Nginx reverse proxy + SSL + static frontend

worker_processes auto;
error_log /var/log/nginx/error.log warn;

events {
  worker_connections 1024;
  multi_accept on;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;
  sendfile      on;
  tcp_nopush    on;
  keepalive_timeout 65;
  gzip on;
  gzip_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;
  gzip_min_length 1024;

  # Logi
  log_format main '$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
  access_log /var/log/nginx/access.log main;

  # Rate limiting
  limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
  limit_req_zone $binary_remote_addr zone=auth:10m rate=10r/m;

  # ── Redirect HTTP → HTTPS ────────────────────────────────────
  server {
    listen 80;
    server_name biznesoutlet.pl www.biznesoutlet.pl;
    return 301 https://biznesoutlet.pl$request_uri;
  }

  # ── HTTPS – główny serwer ────────────────────────────────────
  server {
    listen 443 ssl http2;
    server_name biznesoutlet.pl www.biznesoutlet.pl;

    # SSL – certyfikaty Let's Encrypt (Certbot)
    ssl_certificate     /etc/nginx/ssl/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # ── Frontend (pliki statyczne) ───────────────────────────
    root /var/www/html;
    index index.html;

    location / {
      try_files $uri $uri/ /index.html;
      expires 1h;
      add_header Cache-Control "public, max-age=3600";
    }

    # HTML – bez cache (żeby zawsze był najnowszy)
    location ~* \.html$ {
      expires -1;
      add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    # Pliki statyczne – długi cache
    location ~* \.(js|css|png|jpg|jpeg|webp|svg|woff|woff2|ico)$ {
      expires 30d;
      add_header Cache-Control "public, max-age=2592000, immutable";
    }

    # ── API – proxy do Node.js ───────────────────────────────
    location /api/ {
      limit_req zone=api burst=50 nodelay;
      proxy_pass http://api:3001;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_cache_bypass $http_upgrade;
      proxy_read_timeout 60s;
      proxy_connect_timeout 10s;
      client_max_body_size 50M;
    }

    # Auth – ściślejszy rate limit
    location /api/auth/ {
      limit_req zone=auth burst=20 nodelay;
      proxy_pass http://api:3001;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Webhooks – bez rate limit (przychodzą od Przelewy24)
    location /api/webhooks/ {
      proxy_pass http://api:3001;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_read_timeout 30s;
    }

    # Robots i sitemap
    location = /robots.txt  { log_not_found off; access_log off; }
    location = /favicon.ico { log_not_found off; access_log off; }
  }
}