# Dojo Bay, containerized for Archipelago.
#
# Adapted from the upstream project's deploy/nginx-onion.conf.example. The
# Tor hidden service, TLS-equivalent framing and moderation-queue trust
# decisions all belong to Archipelago's app gate now (it fronts every gated
# port with its own onion, strips clickjacking headers for iframe embedding,
# and enforces the manifest's auth policy) — this file keeps only what is
# still this app's own job: serving the static directory site and proxying
# its self-service API to the Node backend running in the same container.
worker_processes 1;
pid /var/run/nginx.pid;

events {
  worker_connections 1024;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;
  sendfile      on;
  access_log    /dev/stdout;
  error_log     /dev/stderr;

  gzip on;
  gzip_types text/css text/javascript application/javascript application/json image/svg+xml text/markdown;

  server {
    listen 8080;
    server_name _;
    root /app;
    index index.html;

    # The directory data is rewritten every 10 minutes by scripts/update.mjs —
    # keep it fresh rather than letting a browser cache it for a day like the
    # other static assets below.
    location /data/ {
      add_header Cache-Control "max-age=60";
      default_type application/json;
    }

    # Code and markup must revalidate so an image update shows up immediately.
    location ~* \.(html|js|css|md)$ {
      add_header Cache-Control "no-cache";
    }

    # Large, rarely-changing assets can be cached for a day.
    location ~* \.(woff2|png|svg|ico)$ {
      add_header Cache-Control "max-age=86400";
    }

    # --- self-service backend (Auth47 submission API) ---
    location /api/ {
      proxy_pass http://127.0.0.1:8787;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-Host $host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_read_timeout 45s;   # the connection gate + PayNym lookup probe Tor
    }

    # SECURITY: the backend's own source and store (sessions, payment codes,
    # node API keys) live under server/ inside the web root. Never serve it.
    location ^~ /server/ { return 404; }

    # Serve the SPA shell for the admin route (client-side view; auth is
    # enforced by the backend, this only returns the same HTML/JS).
    location = /admin { try_files /index.html =404; }

    location / {
      try_files $uri $uri/ =404;
    }
  }
}