# Reverse proxy pour l'execution en local (profil "standalone").
# En production sur Hetzner, ce role est tenu par le Caddy deja en place.

upstream iot_alarm_app {
    server app:8080;
}

server {
    listen 80;
    server_name _;

    access_log /var/log/nginx/iot-alarm.access.log;
    error_log  /var/log/nginx/iot-alarm.error.log warn;

    # --- WebSocket / SockJS -------------------------------------------------
    # Sans l'upgrade explicite, la negociation STOMP echoue silencieusement et
    # la console retombe indefiniment sur "reconnexion...".
    location /ws {
        proxy_pass http://iot_alarm_app;
        proxy_http_version 1.1;
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host       $host;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Un websocket inactif ne doit pas etre coupe au bout de 60 s :
        # la console reste ouverte des heures sans qu'il se passe rien.
        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
        proxy_buffering     off;
    }

    # --- Application --------------------------------------------------------
    location / {
        proxy_pass http://iot_alarm_app;
        proxy_http_version 1.1;
        proxy_set_header Host       $host;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
    }

    # --- Supervision : non expose ------------------------------------------
    location /actuator/ {
        allow 127.0.0.1;
        allow 172.16.0.0/12;
        deny all;
        proxy_pass http://iot_alarm_app;
        proxy_set_header Host $host;
    }
}