# SPA-aware static server for the AIWoiz React app.
# - try_files fallback so BrowserRouter deep links (/dashboard, /widgets/:id, etc.)
#   don't 404 - every unknown path serves index.html and React handles routing.
# - Long cache for hashed /assets/* (Vite emits content-hashed filenames).
# - No-cache for index.html so new deploys take effect immediately.
# - Gzip on for the standard text mimetypes Vite ships.

server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Don't leak the nginx version.
    server_tokens off;

    # Security headers (Finding 9 of the SEO audit) - applied to ALL responses
    # including errors via `always`. The outer cPanel nginx user-include does
    # NOT carry these (inheritance is gnarly there); the container nginx is
    # the source of truth.
    #
    # nginx gotcha: `add_header` does NOT inherit into a location that defines
    # its OWN `add_header`. The three headers below are therefore RE-DECLARED
    # inside every location that has its own add_header (= /index.html,
    # /assets/, = /_health). Locations without add_header (~\.map$, /)
    # inherit cleanly from here. See ngx_http_headers_module docs.
    add_header X-Content-Type-Options "nosniff"                          always;
    add_header X-Frame-Options        "SAMEORIGIN"                       always;
    add_header Referrer-Policy        "strict-origin-when-cross-origin"  always;

    # Defense-in-depth: refuse to serve source maps even if a build
    # accidentally emits them. vite.config.ts already sets sourcemap:false
    # but this is a regex-anywhere block to catch any future regression at
    # the edge (e.g. someone running `vite build --sourcemap` by mistake).
    location ~ \.map$ {
        return 404;
        access_log off;
    }

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/javascript
        application/json
        application/xml
        image/svg+xml
        font/ttf
        font/otf
        application/x-font-ttf;

    # Hashed assets: safe to cache for a year (Vite content-hashes filenames).
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        # Re-declare security headers (nginx inheritance loses them here).
        add_header X-Content-Type-Options "nosniff"                          always;
        add_header X-Frame-Options        "SAMEORIGIN"                       always;
        add_header Referrer-Policy        "strict-origin-when-cross-origin"  always;
        try_files $uri =404;
    }

    # index.html must NOT be cached, so new deploys are picked up immediately.
    location = /index.html {
        add_header Cache-Control "no-store, no-cache, must-revalidate";
        # Re-declare security headers (nginx inheritance loses them here).
        add_header X-Content-Type-Options "nosniff"                          always;
        add_header X-Frame-Options        "SAMEORIGIN"                       always;
        add_header Referrer-Policy        "strict-origin-when-cross-origin"  always;
        try_files $uri =404;
    }

    # Static files first, then fall back to index.html for client-side routes.
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Optional: lightweight liveness probe for the static server itself
    # (the API has its own /health - this just confirms nginx is up).
    location = /_health {
        access_log off;
        return 200 "ok\n";
        add_header Content-Type text/plain;
        # Re-declare security headers (nginx inheritance loses them here).
        add_header X-Content-Type-Options "nosniff"                          always;
        add_header X-Frame-Options        "SAMEORIGIN"                       always;
        add_header Referrer-Policy        "strict-origin-when-cross-origin"  always;
    }
}