# DEPRECATED — use dwd-stack-lan.conf (FastAPI under /api/fastapi/, / returns 404).
#
# LAN testing — HTTP on port 80 via server IP (before subdomain + SSL).
# Install:
#   sudo cp dwd-api-fastapi-lan.conf /etc/nginx/sites-available/dwd-api-fastapi
#   sudo ln -sf /etc/nginx/sites-available/dwd-api-fastapi /etc/nginx/sites-enabled/
#   sudo rm -f /etc/nginx/sites-enabled/default
#   sudo nginx -t && sudo systemctl reload nginx
#
# Later (server room): replace with subdomain + SSL — see docs/11-nginx-lan-setup.md

upstream dwd_api_fastapi_backend {
    server 127.0.0.1:8001;
    keepalive 32;
}

# Catch-all HTTP for LAN IP access (http://192.168.x.x/health, /docs, etc.)
server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;

    location / {
        proxy_pass http://dwd_api_fastapi_backend;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 300s;
        proxy_send_timeout 300s;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

# --- HTTPS (uncomment when cert paths are ready) ---
#
# server {
#     listen 443 ssl default_server;
#     listen [::]:443 ssl default_server;
#     server_name _;
#
#     ssl_certificate     /etc/ssl/certs/your-fullchain.pem;
#     ssl_certificate_key /etc/ssl/private/your-privkey.pem;
#     ssl_protocols TLSv1.2 TLSv1.3;
#     ssl_prefer_server_ciphers off;
#
#     location / {
#         proxy_pass http://dwd_api_fastapi_backend;
#         proxy_http_version 1.1;
#         proxy_set_header Host $host;
#         proxy_set_header X-Real-IP $remote_addr;
#         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_read_timeout 300s;
#         proxy_send_timeout 300s;
#         proxy_set_header Upgrade $http_upgrade;
#         proxy_set_header Connection "upgrade";
#     }
# }
#
# Optional — redirect HTTP to HTTPS after 443 works:
#
# server {
#     listen 80 default_server;
#     listen [::]:80 default_server;
#     server_name _;
#     return 301 https://$host$request_uri;
# }
