# nginx.conf (envsubst テンプレート) — claude-code gateway
# 受付・認証・WebSocket プロキシの単一入口。read-only rootfs / 非 root で動作する。
worker_processes auto;
pid /tmp/nginx/nginx.pid;
error_log /dev/stderr ${NGINX_ERROR_LEVEL};

events { worker_connections 1024; }

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    access_log    /dev/stdout;

    client_body_temp_path /tmp/nginx/body;
    proxy_temp_path       /tmp/nginx/proxy;
    fastcgi_temp_path     /tmp/nginx/fastcgi;
    uwsgi_temp_path       /tmp/nginx/uwsgi;
    scgi_temp_path        /tmp/nginx/scgi;

    sendfile on;
    tcp_nopush on;
    server_tokens off;
    client_max_body_size 25m;

    map $http_upgrade $connection_upgrade { default upgrade; '' close; }

    resolver ${NGINX_RESOLVER} valid=10s ipv6=off;

    server {
        listen ${GATEWAY_PORT};
        listen [::]:${GATEWAY_PORT};

        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options SAMEORIGIN always;
        add_header Referrer-Policy no-referrer always;

        # ---- HTTP Basic（auth.mode=basic のときのみ内容を持つ）----
        include /tmp/nginx/auth_basic.conf;

        location = /healthz {
            auth_basic off;
            proxy_pass http://127.0.0.1:${MANAGER_PORT}/healthz;
        }

        # ---- auth_request の実体（auth.mode=token|forward）----
        location = /_auth {
            internal;
            proxy_pass_request_body off;
            proxy_set_header Content-Length "";
            proxy_set_header X-Original-URI $request_uri;
            proxy_set_header X-Original-Method $request_method;
            include /tmp/nginx/auth_backend.conf;
        }

        # ---- 制御プレーン（UI / API）----
        location / {
            include /tmp/nginx/auth_request.conf;
            proxy_pass http://127.0.0.1:${MANAGER_PORT};
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # UI とログインは常に到達可能にする（token モードのログイン導線のため）
        location = /            { proxy_pass http://127.0.0.1:${MANAGER_PORT}; proxy_set_header Host $host; }
        location = /index.html  { proxy_pass http://127.0.0.1:${MANAGER_PORT}; proxy_set_header Host $host; }
        location = /login       { proxy_pass http://127.0.0.1:${MANAGER_PORT}; proxy_set_header Host $host; }
        location = /api/config  {
            include /tmp/nginx/auth_request.conf;
            proxy_pass http://127.0.0.1:${MANAGER_PORT};
            proxy_set_header Host $host;
        }

        # ---- セッションへのリバースプロキシ（WebSocket 対応）----
        location ~ ^/s/(?<sid>[a-f0-9]{10})(?<rest>/.*)?$ {
            include /tmp/nginx/auth_basic.conf;
            include /tmp/nginx/auth_request.conf;
            error_page 401 = @needlogin;

            set $rest_path $rest;
            if ($rest_path = "") { set $rest_path /; }
            set $sess_backend "http://claude-sess-$sid.${SESSIONS_NS}.svc.cluster.local:${TTYD_PORT}";

            proxy_pass $sess_backend$rest_path$is_args$args;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_buffering off;
        }

        location @needlogin {
            return 302 /?next=$request_uri;
        }
    }
}