# Request ID correlation
map $http_x_request_id $req_id {
    default $http_x_request_id;
    ""      $request_id;
}

# HTTP → HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name _;

    return 301 https://$host$request_uri;
}

# HTTPS — Hardened + ModSecurity
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name _;

    server_tokens off;

    # ---------------------------------------------------
    # TLS (certs copiés par ansible/playbook-certbot.yml, voir
    # docker-compose.yml service waf)
    # ---------------------------------------------------
    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    ssl_protocols             TLSv1.2 TLSv1.3;
    ssl_ciphers               ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    resolver 127.0.0.11 valid=10s ipv6=off;
    resolver_timeout 5s;

    # ---------------------------------------------------
    # En-têtes de sécurité
    # ---------------------------------------------------
    add_header Strict-Transport-Security  "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options            "DENY"                                         always;
    add_header X-Content-Type-Options     "nosniff"                                      always;
    add_header Referrer-Policy            "no-referrer"                                  always;
    # Le SPA (Vite/React) est servi en même origine (proxifié ci-dessous) et
    # utilise Chakra UI/Emotion, qui injecte des <style> au runtime (CSS-in-JS)
    # — d'où "style-src 'unsafe-inline'". Pas de script inline dans
    # web/index.html (un seul <script type="module" src="/src/main.tsx">),
    # donc script-src reste strict à 'self'.
    add_header Content-Security-Policy    "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;

    # ---------------------------------------------------
    # Limites et timeouts
    # ---------------------------------------------------
    client_max_body_size        10M;
    client_body_buffer_size     128k;
    client_header_buffer_size   1k;
    large_client_header_buffers 4 8k;

    client_body_timeout   30s;
    client_header_timeout 30s;
    send_timeout          30s;
    keepalive_timeout     65s;

    # ---------------------------------------------------
    # ModSecurity WAF
    # ---------------------------------------------------
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsec/custom-rules.conf;

    # ---------------------------------------------------
    # API control-plane Go (voir control-plane/api/internal/router)
    # ---------------------------------------------------
    location /api/ {
        limit_except GET POST PATCH DELETE OPTIONS { deny all; }

        set $upstream_api http://api:8080;
        proxy_pass         $upstream_api;
        proxy_http_version 1.1;
        proxy_set_header   Connection        "";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   X-Request-ID      $req_id;
        proxy_hide_header  X-Powered-By;

        proxy_connect_timeout 60s;
        proxy_send_timeout    300s;
        proxy_read_timeout    300s;
    }

    location = /healthz {
        set $upstream_api http://api:8080;
        proxy_pass $upstream_api;
    }

    # ---------------------------------------------------
    # Frontend React SPA
    # ---------------------------------------------------
    location / {
        set $upstream_web http://web:80;
        proxy_pass         $upstream_web;
        proxy_http_version 1.1;
        proxy_set_header   Connection        "";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }

    # ---------------------------------------------------
    # Blocage fichiers sensibles / scans courants
    # ---------------------------------------------------
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }

    location ~* \.(env|git|sql|bak|log|conf|ini|sh)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    location ~* (package\.json|package-lock\.json|yarn\.lock|Dockerfile|docker-compose)$ {
        deny all;
        access_log off;
        log_not_found off;
    }

    location ~* (wp-admin|wp-login|wp-content|xmlrpc|\.php)$ {
        deny all;
        access_log off;
        log_not_found off;
    }
}