# ============================================================
# OpenDance Studio Web 服务端 —— nginx 反向代理样例
#
# 说明：本 Web 端不自带反向代理。本文件是**给你的反代服务参考**的配置样例，
#       由部署 `deploy/install.sh` 之外的反代负责人使用。
#
# 特点：后端（NestJS）自带管理端页面与 SPA 回退，因此这里
#       只需一个全匹配 location 把请求整体转发过去即可，
#       不需要 root/try_files 托管静态文件。
#
# 安装：
#   Debian/Ubuntu: /etc/nginx/sites-available/opendance.conf（再软链到 sites-enabled/）
#   RHEL 系:       /etc/nginx/conf.d/opendance.conf
# 校验并重载： nginx -t && systemctl reload nginx
# ============================================================

upstream opendance_api {
    # 后端地址：同机用 127.0.0.1；异机改成实际 IP，并在后端放防火墙
    server 127.0.0.1:3000;
    keepalive 16;
}

server {
    listen      80;
    listen      [::]:80;
    server_name your.domain.com;        # 改成实际域名或 _

    # 字符集：管理端与 API 都是 UTF-8
    charset utf-8;

    # ★ 上传上限：后端默认允许 512 MiB，nginx 默认仅 1 MB，
    #   不改会导致 VRM / FBX 等大文件上传直接 413。
    client_max_body_size 512m;
    client_body_timeout  300s;

    access_log /var/log/nginx/opendance.access.log;
    error_log  /var/log/nginx/opendance.error.log;

    # ---- 全部请求转发给后端 ----
    # 管理端页面、前端路由深链接、/api、/health、/static、/contracts
    # 全部由后端处理，所以这里只需一条规则。
    location / {
        proxy_pass         http://opendance_api;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # 配合 upstream keepalive，避免 Connection: close
        proxy_set_header Connection        "";

        # ★ 超时：大文件上传与关键点序列下载都可能较慢
        proxy_connect_timeout 30s;
        proxy_send_timeout    300s;
        proxy_read_timeout    300s;

        # 大文件直接透传，不在代理层落盘
        proxy_request_buffering off;
        proxy_buffering         off;
    }

    # 健康检查可单独放开日志噪音（可选）
    location = /health {
        proxy_pass       http://opendance_api/health;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        access_log off;
    }

    gzip on;
    gzip_types text/plain text/css application/json application/javascript
               application/x-ndjson text/xml application/xml image/svg+xml;
    gzip_min_length 1024;

    # 若前端资源由后端返回，代理层不要缓存 HTML，避免升级后页面不更新
    location ~* \.html$ {
        proxy_pass       http://opendance_api;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        add_header Cache-Control "no-cache";
    }
}

# ============================================================
# 可选：HTTPS 终止在反代（后端只监听 HTTP）
#
# server {
#     listen 443 ssl;
#     http2 on;
#     server_name your.domain.com;
#
#     ssl_certificate     /etc/nginx/ssl/opendance.crt;
#     ssl_certificate_key /etc/nginx/ssl/opendance.key;
#     ssl_protocols       TLSv1.2 TLSv1.3;
#
#     client_max_body_size 512m;
#
#     location / {
#         proxy_pass         http://opendance_api;
#         proxy_http_version 1.1;
#         proxy_set_header Host              $host;
#         proxy_set_header X-Real-IP         $remote_addr;
#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_send_timeout 300s;
#         proxy_read_timeout 300s;
#         proxy_request_buffering off;
#     }
# }
# ============================================================

# ============================================================
# 可选：本服务未内置登录认证，如需公网访问请在反代加一层防护
#
# location / {
#     auth_basic           "OpenDance Studio";
#     auth_basic_user_file /etc/nginx/.htpasswd;   # htpasswd -c 生成
#     proxy_pass http://opendance_api;
#     ...
# }
# ============================================================