worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    # ======================================================================
    # Logging
    # ======================================================================
    log_format main '$remote_addr [$time_local] "$request" '
                    '$status $body_bytes_sent rt=$request_time '
                    'auth=$auth_status';

    access_log /var/log/nginx/access.log main;

    # Hide nginx version
    server_tokens off;

    # ======================================================================
    # Bearer Token Authentication
    # ======================================================================
    map_hash_bucket_size 128;
    map $http_authorization $auth_status {
        default       "denied";
        "Bearer ${GATEWAY_API_TOKEN}" "ok";
    }

    # ======================================================================
    # Upstreams
    # ======================================================================
    # NOTE: nginx resolves all upstream hostnames at config load time.
    # Missing names abort startup, so only deployed services are listed here.
    # Re-enable an upstream when its container exists on this host.
    #
    # upstream llm {
    #     server didiAI-llm-api:14011;
    # }
    #
    # upstream audio {
    #     server didiAI-audio-api:54300;
    # }

    upstream web {
        server didiAI-web-api:51100;
    }

    upstream catalog {
        server didiAI-catalog-api:11000;
    }

    # upstream embeddings {
    #     server didiAI-embeddings-api:14100;
    # }
    #
    # upstream rerank {
    #     server didiAI-rerank-api:14200;
    # }

    # ======================================================================
    # Gateway Server
    # ======================================================================
    server {
        listen 11000;
        server_name _;

        # Max upload size (audio files up to 500MB)
        client_max_body_size 500M;

        # Default JSON content type for error responses
        default_type application/json;

        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 300s;
        proxy_read_timeout 600s;

        # Common proxy headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Request-ID $request_id;

        # ==================================================================
        # Health - NO auth required
        # ==================================================================
        location = /health {
            access_log off;
            default_type application/json;
            return 200 '{"status":"ok","service":"didiAI-gateway"}';
        }

        # ==================================================================
        # LLM Inference / Audio Transcription — DISABLED on this host
        # (didiAI-llm-api and didiAI-audio-api containers not present locally)
        # Re-enable the upstream block above + location block below when deployed.
        # ==================================================================
        # location /llm/ {
        #     if ($auth_status = "denied") {
        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
        #     }
        #     proxy_pass http://llm/;
        #     proxy_buffering off;
        #     proxy_cache off;
        #     proxy_set_header Connection '';
        #     proxy_http_version 1.1;
        #     chunked_transfer_encoding on;
        # }
        #
        # location /audio/ {
        #     if ($auth_status = "denied") {
        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
        #     }
        #     proxy_pass http://audio/;
        #     client_body_buffer_size 10M;
        # }

        # ==================================================================
        # Web Fact-checking - /web/
        # ==================================================================
        location /web/ {
            if ($auth_status = "denied") {
                return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
            }

            proxy_pass http://web/;
        }

        # ==================================================================
        # Catalog (internal monitoring) - /catalog/
        # ==================================================================
        location /catalog/ {
            if ($auth_status = "denied") {
                return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
            }

            proxy_pass http://catalog/;
        }

        # ==================================================================
        # Embeddings / Rerank — DISABLED on this host
        # (FastAPI wrappers not deployed; live BGE-M3 servers run elsewhere)
        # Re-enable the upstream blocks above + location blocks below when deployed.
        # ==================================================================
        # location /embeddings/ {
        #     if ($auth_status = "denied") {
        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
        #     }
        #     proxy_pass http://embeddings/;
        # }
        #
        # location /rerank/ {
        #     if ($auth_status = "denied") {
        #         return 401 '{"error":"unauthorized","message":"Invalid or missing Bearer token"}';
        #     }
        #     proxy_pass http://rerank/;
        # }

        # ==================================================================
        # Default - show available routes
        # ==================================================================
        location / {
            default_type application/json;
            return 404 '{"error":"not_found","routes":["/web/","/catalog/","/health"]}';
        }
    }
}