events {
    worker_connections 1024;
}

http {
    resolver 127.0.0.11 valid=30s ipv6=off;

    limit_req_zone $binary_remote_addr zone=api:10m rate=300r/m;

    server {
        listen 80;
        server_name localhost;

        client_max_body_size 100M;

        gzip on;
        gzip_types application/json text/plain;
        gzip_min_length 1000;

        # ── Core API ─────────────────────────────────────────────────────────
        location / {
            limit_req zone=api burst=50 nodelay;

            set $upstream_api api;
            proxy_pass http://$upstream_api:9000;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    300s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
            chunked_transfer_encoding on;

            # Retry on upstream errors — prevents hanging on stale DNS entries
            # after container restarts.
            proxy_next_upstream error timeout http_502 http_503 http_504;
            proxy_next_upstream_tries 2;

            # Disable buffering for SSE — tells upstream proxies and CDNs
            # (Cloudflare, ALB, etc.) not to buffer the streaming response.
            add_header X-Accel-Buffering no;
        }

        # ── Training API ─────────────────────────────────────────────────────
        location /v1/datasets/ {
            set $upstream_training training_api;
            proxy_pass http://$upstream_training:9001;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    300s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
            client_max_body_size 500M;
        }

        location /v1/training-jobs/ {
            set $upstream_training training_api;
            proxy_pass http://$upstream_training:9001;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    600s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    300s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
        }

        location /v1/fine-tuned-models/ {
            set $upstream_training training_api;
            proxy_pass http://$upstream_training:9001;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    300s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
        }

        location /v1/inference-deployments/ {
            set $upstream_training training_api;
            proxy_pass http://$upstream_training:9001;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    300s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
        }

        location /v1/registry/ {
            set $upstream_training training_api;
            proxy_pass http://$upstream_training:9001;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    300s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
        }

        location /v1/deployments/ {
            set $upstream_training training_api;
            proxy_pass http://$upstream_training:9001;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    300s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    300s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
        }

        # ── Ray Serve — admin monitoring only ─────────────────────────────────
        location /serve/ {
            set $upstream_inference inference_worker;
            proxy_pass http://$upstream_inference:8000/;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    60s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    60s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
        }

        # ── Ray Dashboard ─────────────────────────────────────────────────────
        location /ray/ {
            set $upstream_inference inference_worker;
            proxy_pass http://$upstream_inference:8265/;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            proxy_read_timeout    60s;
            proxy_connect_timeout 10s;
            proxy_send_timeout    60s;

            proxy_http_version 1.1;
            proxy_set_header   Connection "";
            proxy_buffering    off;
        }

        # ── WebSocket endpoints ───────────────────────────────────────────────
        location /ws/ {
            set $upstream_api api;
            proxy_pass http://$upstream_api:9000;

            proxy_http_version 1.1;
            proxy_set_header Upgrade   $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host      $host;
            proxy_read_timeout 3600s;
        }

        # ── Jaeger UI ─────────────────────────────────────────────────────────
        location /jaeger/ {
            set $upstream_jaeger jaeger_ui;
            proxy_pass http://$upstream_jaeger:16686/;

            proxy_set_header Host            $host;
            proxy_set_header X-Real-IP       $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
    }

    # ── HTTPS server block (Placeholder) ─────────────────────────────────────
    # To enable:
    #   1. Place certs at ./docker/nginx/certs/fullchain.pem and privkey.pem
    #   2. Uncomment the ports and volume mounts in docker-compose.yml
    #
    # server {
    #     listen 443 ssl;
    #     server_name yourdomain.com;
    #
    #     ssl_certificate     /etc/nginx/certs/fullchain.pem;
    #     ssl_certificate_key /etc/nginx/certs/privkey.pem;
    #     ssl_protocols       TLSv1.2 TLSv1.3;
    #     ssl_ciphers         HIGH:!aNULL:!MD5;
    #
    #     client_max_body_size 100M;
    #     gzip on;
    #
    #     location / {
    #         set $upstream_api api;
    #         proxy_pass http://$upstream_api:9000;
    #         add_header X-Accel-Buffering no;
    #         proxy_next_upstream error timeout http_502 http_503 http_504;
    #         proxy_next_upstream_tries 2;
    #     }
    #
    #     location /v1/datasets/ {
    #         set $upstream_training training_api;
    #         proxy_pass http://$upstream_training:9001;
    #         client_max_body_size 500M;
    #     }
    #
    #     location /v1/training-jobs/ {
    #         set $upstream_training training_api;
    #         proxy_pass http://$upstream_training:9001;
    #     }
    #
    #     location /v1/fine-tuned-models/ {
    #         set $upstream_training training_api;
    #         proxy_pass http://$upstream_training:9001;
    #     }
    #
    #     location /v1/inference-deployments/ {
    #         set $upstream_training training_api;
    #         proxy_pass http://$upstream_training:9001;
    #     }
    #
    #     location /v1/registry/ {
    #         set $upstream_training training_api;
    #         proxy_pass http://$upstream_training:9001;
    #     }
    #
    #     location /v1/deployments/ {
    #         set $upstream_training training_api;
    #         proxy_pass http://$upstream_training:9001;
    #     }
    #
    #     location /serve/ {
    #         set $upstream_inference inference_worker;
    #         proxy_pass http://$upstream_inference:8000/;
    #     }
    #
    #     location /ray/ {
    #         set $upstream_inference inference_worker;
    #         proxy_pass http://$upstream_inference:8265/;
    #     }
    # }
}