# TLS edge for the released maintainerd-auth image.
#
# Terminates HTTPS and forwards plain HTTP (with X-Forwarded-Proto) to the single
# container, which serves the SPAs AND routes their APIs same-origin internally.
# This is what lets you use clean hostnames with NO ports.
#
# NOTE: every proxy_pass goes through a `set $var` variable on purpose. With a
# variable, nginx resolves the upstream at REQUEST time via `resolver` instead of
# at startup — so nginx boots even before the `auth` container is up, and never
# fails with "host not found in upstream".

resolver 127.0.0.11 valid=10s ipv6=off;

ssl_certificate     /etc/nginx/certs/auth.maintainerd.local.crt;
ssl_certificate_key /etc/nginx/certs/auth.maintainerd.local.key;
ssl_protocols TLSv1.2 TLSv1.3;

# Auth cookies (httpOnly Set-Cookie) overflow nginx's default proxy header buffer.
proxy_buffer_size 16k;
proxy_buffers 8 16k;
proxy_busy_buffers_size 16k;

# Send all HTTP to HTTPS.
server {
    listen 80 default_server;
    server_name *.auth.maintainerd.local;
    return 308 https://$host$request_uri;
}

# Control plane API — console-api.auth.maintainerd.local -> :8080
server {
    listen 443 ssl;
    server_name console-api.auth.maintainerd.local;
    location /api/ {
        set $upstream http://auth:8080;
        proxy_pass $upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Data plane API + OIDC issuer — identity-api.auth.maintainerd.local -> :8081
server {
    listen 443 ssl;
    server_name identity-api.auth.maintainerd.local;
    location /.well-known/ {
        set $upstream http://auth:8081;
        proxy_pass $upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location /api/ {
        set $upstream http://auth:8081;
        proxy_pass $upstream;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Admin console — console.auth.maintainerd.local -> :3000 (SPA + same-origin APIs)
server {
    listen 443 ssl;
    server_name console.auth.maintainerd.local;
    location / {
        set $upstream http://auth:3000;
        proxy_pass $upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# Hosted login — identity.auth.maintainerd.local -> :3001
server {
    listen 443 ssl;
    server_name identity.auth.maintainerd.local;
    location / {
        set $upstream http://auth:3001;
        proxy_pass $upstream;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}