# SEO Insight — Nginx reverse proxy for the Next app.
# Install at /etc/nginx/sites-available/dash.seoinsight.app, symlink into
# sites-enabled, then `sudo certbot --nginx -d dash.seoinsight.app` upgrades
# this to HTTPS (adds the 443 server + the 80→443 redirect automatically) and
# renews the cert. Firecrawl (127.0.0.1:3002) is NOT proxied — it stays internal.

server {
    listen 80;
    listen [::]:80;
    server_name dash.seoinsight.app;

    server_tokens off;

    # CSV keyword import (up to ~50 Mo) + Stripe webhooks post sizeable bodies.
    client_max_body_size 60M;

    # Buffers + timeouts suited to Server Actions and the heavy-import upload.
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;

    # gzip — chiefly for the statically-served /_next/static below (Next already
    # gzips its PROXIED responses; nginx skips anything already encoded).
    gzip on;
    gzip_proxied any;
    gzip_comp_level 5;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/javascript application/json
               image/svg+xml application/xml application/manifest+json;

    # Immutable, content-hashed build assets — serve straight from disk so Node
    # never proxies them. Path follows the /opt → /data symlink. If these ever
    # 404 (perm/path), comment this block out: Next will serve them again.
    location /_next/static/ {
        alias /opt/seo-insight/.next/static/;
        access_log off;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
    }

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        # Standard forwarded host header (harmless, good practice). NOTE: this was
        # NOT what fixed the /under-construction 500 — Next ignores it here
        # (experimental.trustHostHeader is an invalid key). The real fix was
        # removing the middleware rewrite that self-fetched https://localhost:3000;
        # WIP gating now lives in the route segment layouts. See src/proxy.ts.
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # WebSocket upgrade passthrough.
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_cache_bypass $http_upgrade;
    }
}