# Reverse proxy único (agente.md seção 87): expõe frontend + API na mesma
# origem para o navegador, o que também elimina CORS e problemas de cookie
# cross-origin — frontend e API nunca ficam expostos diretamente ao host.
worker_processes 1;

events {
  worker_connections 512;
}

http {
  include       mime.types;
  default_type  application/octet-stream;
  sendfile      on;
  client_max_body_size 55m;

  log_format main '$remote_addr - [$time_local] "$request" $status $body_bytes_sent "$http_referer"';
  access_log /dev/stdout main;
  error_log /dev/stderr warn;

  upstream frontend_upstream {
    server frontend:3000;
  }

  upstream api_upstream {
    server api:3000;
  }

  server {
    listen 80;
    server_name _;

    location /api/ {
      proxy_pass http://api_upstream;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /_next/webpack-hmr {
      proxy_pass http://frontend_upstream;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
    }

    location / {
      proxy_pass http://frontend_upstream;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
  }
}