# proxy-ng 节点 nginx 模板。
# 部署时替换 {{DOMAIN}}、{{BACKEND_ORIGIN}}、{{BACKEND_ORIGIN_HOST}}、{{NODE_NAME}}、{{TLS_CERT_PATH}}、{{TLS_KEY_PATH}}。
# 真实 token 不写入模板产物；节点通过 root-only 文件 include，例如 /etc/nginx/proxy-ng/token.conf。

worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 1024;
    multi_accept on;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    sendfile on;
    tcp_nopush on;
    keepalive_timeout 30s;
    keepalive_requests 100;

    client_header_timeout 10s;
    client_body_timeout 30s;
    client_max_body_size 256m;

    limit_conn_zone $binary_remote_addr zone=conn_per_ip:10m;
    limit_req_zone $binary_remote_addr zone=req_per_ip:10m rate=30r/s;
    limit_req_zone $binary_remote_addr zone=req_auth:10m rate=10r/m;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        "" close;
    }

    server {
        listen 80;
        server_name {{DOMAIN}};
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl http2;
        server_name {{DOMAIN}};

        ssl_certificate {{TLS_CERT_PATH}};
        ssl_certificate_key {{TLS_KEY_PATH}};
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_session_cache shared:SSL:20m;
        ssl_session_timeout 10m;

        include {{PROXY_NG_TOKEN_FILE}};

        limit_conn conn_per_ip 20;
        limit_req zone=req_per_ip burst=30 nodelay;
        limit_req_status 429;

        add_header X-Proxy-Ng-Node "{{NODE_NAME}}" always;
        add_header X-Content-Type-Options nosniff always;

        location = /health {
            proxy_pass {{BACKEND_ORIGIN}}/health;
            proxy_ssl_server_name on;
            proxy_ssl_name {{BACKEND_ORIGIN_HOST}};
            proxy_set_header Host {{BACKEND_ORIGIN_HOST}};
            proxy_set_header X-Proxy-Ng-Token $proxy_ng_expected_token;
            proxy_set_header X-Proxy-Ng-Node "{{NODE_NAME}}";
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_buffering off;
            access_log off;
        }

        location ~ ^/api/v1/auth/(login|login/2fa|register|send-verify-code|forgot-password|reset-password) {
            limit_conn conn_per_ip 5;
            limit_req zone=req_auth burst=3 nodelay;
            limit_req_status 429;

            proxy_pass {{BACKEND_ORIGIN}};
            proxy_ssl_server_name on;
            proxy_ssl_name {{BACKEND_ORIGIN_HOST}};
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Host {{BACKEND_ORIGIN_HOST}};
            proxy_set_header X-Proxy-Ng-Token $proxy_ng_expected_token;
            proxy_set_header X-Proxy-Ng-Node "{{NODE_NAME}}";
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_buffering off;
        }

        location / {
            proxy_pass {{BACKEND_ORIGIN}};
            proxy_ssl_server_name on;
            proxy_ssl_name {{BACKEND_ORIGIN_HOST}};
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Host {{BACKEND_ORIGIN_HOST}};
            proxy_set_header X-Proxy-Ng-Token $proxy_ng_expected_token;
            proxy_set_header X-Proxy-Ng-Node "{{NODE_NAME}}";
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_buffering off;
            proxy_request_buffering off;
        }
    }
}