# ---------------------------------------------------------------------------
# Edge routing.
#
# In production Cloudflare terminates TLS and sits in front of this; Nginx
# handles routing, buffering, compression and the per-IP rate ceiling. TLS
# config is intentionally absent here because the local stack is plain HTTP.
# ---------------------------------------------------------------------------

upstream storefront_upstream {
    server storefront:3000;
    keepalive 32;
}

upstream admin_upstream {
    server admin:3001;
    keepalive 32;
}

upstream api_upstream {
    server api:4000;
    keepalive 32;
}

# --- Admin dashboard: separate hostname ------------------------------------
# A distinct origin means an XSS on the storefront cannot reach admin cookies,
# and the whole host can be IP-restricted or put behind Cloudflare Access.
server {
    listen 80;
    server_name admin.localhost;

    add_header X-Robots-Tag "noindex, nofollow" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;

    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://api_upstream;
    }

    location / {
        limit_req zone=web_limit burst=40 nodelay;
        proxy_pass http://admin_upstream;
    }
}

# --- Storefront + public API -----------------------------------------------
server {
    listen 80 default_server;
    server_name localhost _;

    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location /api/ {
        limit_req zone=api_limit burst=20 nodelay;
        proxy_pass http://api_upstream;

        # Payment webhooks and image uploads must not be truncated by a short
        # read timeout; everything else here is fast anyway.
        proxy_read_timeout 60s;
        proxy_buffering off;
    }

    location = /health {
        access_log off;
        proxy_pass http://api_upstream/api/v1/health/live;
    }

    # Next.js build output is content-hashed and therefore immutable.
    location /_next/static/ {
        proxy_pass http://storefront_upstream;
        proxy_cache_valid 200 365d;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    location / {
        limit_req zone=web_limit burst=40 nodelay;
        proxy_pass http://storefront_upstream;
    }
}