# Nginx 反向代理配置模板（test 环境）
#
# 用途：frontend-test.banlv-ai.com → http://localhost:3000 (Next.js)
#
# **关键**：转发 `Host` / `X-Forwarded-Host` / `X-Forwarded-Proto` 请求头
#   —— NextAuth v4 靠这些**算**对 OAuth callback 的 `redirect_uri`
#   —— **不**传的话 Next.js 看**到** `Host: localhost:3000`，
#      `redirect_uri = http://localhost:3000/api/auth/callback/facebook`
#      → Facebook 拒**绝**（**不**在白名单）→ 跳 error?error=OAuthSignin
#
# 部署步骤（**手**动，**不**会**自**动部署）：
#   1. cp scripts/deploy/nginx-frontend-test.conf.example /etc/nginx/sites-available/frontend-test.banlv-ai.com
#   2. ln -s /etc/nginx/sites-available/frontend-test.banlv-ai.com /etc/nginx/sites-enabled/
#   3. certbot --nginx -d frontend-test.banlv-ai.com  # 如果**还**没**装** SSL
#   4. nginx -t && nginx -s reload

server {
    listen 80;
    listen [::]:80;
    server_name frontend-test.banlv-ai.com;

    # **强**制 HTTPS（**可**选 —— 如**果**已经**有** certbot，**让** certbot **自**动**加** 301）
    # return 301 https://$host$request_uri;

    # **可**选：acme-challenge 给 certbot 验证**用**
    # location /.well-known/acme-challenge/ {
    #     root /var/www/html;
    # }

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;

        # **核心** —— 转发**公**网 host / protocol 给 Next.js
        # NextAuth v4 **优**先**级**：
        #   1. NEXTAUTH_URL env
        #   2. Host 头（nginx **不**转发 = Next.js 看**到** localhost:3000）❌
        #   3. X-Forwarded-Host 头 ← **这**行**关**键，**不**传就 GG
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Port  $server_port;

        # WebSocket 支持（Next.js HMR + 业务 WS）
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";

        # 超时
        proxy_connect_timeout 60s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;
    }
}

# HTTPS server block（certbot 会**自**动**生**成）
# 如**果** certbot **没**自**动**加，**手**动**复**制**下**面
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name frontend-test.banlv-ai.com;

    ssl_certificate     /etc/letsencrypt/live/frontend-test.banlv-ai.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/frontend-test.banlv-ai.com/privkey.pem;

    # SSL 配置（**参**考 Mozilla Intermediate）
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # HSTS
    add_header Strict-Transport-Security "max-age=63072000" always;
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;

        # **核心** —— 转发**公**网 host / protocol（**与** HTTP block **同**）
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Port  $server_port;

        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_connect_timeout 60s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;
    }
}