# 公网测试：jxd.jinniu.ink 终止 TLS，反代到本机回环上的 OpenIM / 账号 / 对象存储 / LiveKit。
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 4096;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    sendfile on;
    server_tokens off;
    client_max_body_size 100m;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    upstream openim_api {
        server 127.0.0.1:10002;
    }
    upstream openim_ws {
        server 127.0.0.1:10001;
    }
    upstream account_api {
        server 127.0.0.1:10010;
    }
    upstream minio_s3 {
        server 127.0.0.1:10005;
    }
    upstream livekit_signal {
        server 127.0.0.1:17880;
    }

    server {
        listen 80;
        listen [::]:80;
        server_name jxd.jinniu.ink;

        location /.well-known/acme-challenge/ {
            root /var/www/acme;
        }

        location / {
            return 301 https://$host$request_uri;
        }
    }

    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name jxd.jinniu.ink;

        ssl_certificate /etc/letsencrypt/live/jxd.jinniu.ink/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/jxd.jinniu.ink/privkey.pem;
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers off;

        # OpenIM 消息长连接
        location /msg_gateway {
            proxy_pass http://openim_ws/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
        }

        # 公司账号服务（登录、管理页、rtc_token）
        location /account/ {
            proxy_pass http://account_api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # MinIO 对象（MINIO_EXTERNAL_ADDRESS=https://jxd.jinniu.ink/files）
        location /files/ {
            proxy_pass http://minio_s3/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_request_buffering off;
        }

        # LiveKit 信令（客户端 wss://jxd.jinniu.ink/livekit → 容器 /rtc 等）
        location /livekit/ {
            proxy_pass http://livekit_signal/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
        }

        # OpenIM REST API（catch-all，须放最后）
        location / {
            proxy_pass http://openim_api;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}