# nginx reverse proxy for the LPRA server.
# TLS is terminated here; the Go server listens on 127.0.0.1:8091.
#
# Put this in /etc/nginx/sites-available/lp_agent and symlink it into
# sites-enabled, then:  sudo nginx -t && sudo systemctl reload nginx
#
# Agents connect by WebSocket (from 0.1.0), with HTTP long polling to fall
# back on; the browser uses plain HTTP. The settings that matter:
#   - Upgrade / Connection headers -> let the agents' WebSocket through
#   - proxy_buffering off          -> deliver long-poll responses immediately
#   - proxy_read_timeout 300s      -> longer than the 25s long-poll hold
#
# NOTE: proxy_pass MUST start with "http://". A bare "proxy_pass 127.0.0.1:8091;"
# causes nginx error:  [emerg] invalid URL prefix.

# "Connection: upgrade" for a WebSocket, "close" for everything else.


map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl;
    server_name example.ru;

    ssl_certificate /etc/letsencrypt/live/REDACTED/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/REDACTED/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    # Files go through the panel in 4 MB pieces; 64m leaves room for a client
    # that predates the pieces, which takes a file of up to 32 MB in one request.
    client_max_body_size 120m;

    location / {
        proxy_pass http://127.0.0.1:8091;

        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Agents' WebSocket.
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;

        # Long-poll behaviour: no buffering, generous read timeout.
        proxy_buffering     off;
        proxy_cache         off;
        # Pass uploads on as they arrive: the speed test through the browser
        # times them on the client.
        proxy_request_buffering off;
        proxy_read_timeout  300s;
        proxy_send_timeout  300s;
    }
}