# 只允許 websocket 的 Upgrade 通過，其餘（含 h2c）一律清空，避免 H2C smuggling 繞過反向代理控管。
map $http_upgrade $proxy_upgrade {
    default      "";
    "websocket"  $http_upgrade;
}
map $http_upgrade $proxy_connection {
    default      "";
    "websocket"  "upgrade";
}

server {
    listen 80;

    location /app/ {
        proxy_pass http://nextjs:3001/;
        # nosemgrep: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling -- 上方 map 已僅放行 websocket 的 Upgrade，其餘（含 h2c）清空，h2c smuggling 已緩解
        proxy_http_version 1.1;
        proxy_set_header Upgrade $proxy_upgrade;
        proxy_set_header Connection $proxy_connection;
        # nosemgrep: generic.nginx.security.request-host-used.request-host-used -- 反向代理需將原始 Host 傳給後端以產生正確 URL；後端位於信任網路內，為刻意保留
        proxy_set_header Host $host;
        # 覆寫（非附加）客戶端 IP 標頭：XFF 直接以 $remote_addr 覆寫，避免客戶端自報
        # X-Forwarded-For 偽造來源 IP，繞過應用層每 IP 速率限制（proxy.getClientIp）。
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $proxy_upgrade;
    }

    location / {
        proxy_pass http://assetpilot:3000/;
        # nosemgrep: generic.nginx.security.possible-h2c-smuggling.possible-nginx-h2c-smuggling -- 上方 map 已僅放行 websocket 的 Upgrade，其餘（含 h2c）清空，h2c smuggling 已緩解
        proxy_http_version 1.1;
        proxy_set_header Upgrade $proxy_upgrade;
        proxy_set_header Connection $proxy_connection;
        # nosemgrep: generic.nginx.security.request-host-used.request-host-used -- 反向代理需將原始 Host 傳給後端以產生正確 URL；後端位於信任網路內，為刻意保留
        proxy_set_header Host $host;
        # 覆寫（非附加）客戶端 IP 標頭：XFF 直接以 $remote_addr 覆寫，避免客戶端自報
        # X-Forwarded-For 偽造來源 IP，繞過應用層每 IP 速率限制（proxy.getClientIp）。
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $proxy_upgrade;
    }
}