# Client: gqc — HTTPS on hydrotrek.org (host ports 8001–8003).
#
# Public paths (browser)          →  Container path
#   /gqc/api/fastapi/*            →  /*           (strip /gqc/api/fastapi/)
#   /gqc/api/mcp                  →  /mcp
#   /gqc/api/copilotkit/*         →  /api/copilotkit/*
#
# Install:
#   sudo cp dwd-gqc-lan.conf /etc/nginx/sites-available/dwd-gqc
#   sudo ln -sf /etc/nginx/sites-available/dwd-gqc /etc/nginx/sites-enabled/
#   sudo rm -f /etc/nginx/sites-enabled/default /etc/nginx/sites-enabled/dwd-stack
#   sudo nginx -t && sudo systemctl reload nginx
#
# Examples:
#   https://www.hydrotrek.org/gqc/api/fastapi/health
#   https://www.hydrotrek.org/gqc/api/copilotkit
#   https://www.hydrotrek.org/gqc/api/mcp
# Public IP: 74.83.141.228

upstream dwd_gqc_api_fastapi {
    server 127.0.0.1:8001;
    keepalive 32;
}

upstream dwd_gqc_mcp_fastmcp {
    server 127.0.0.1:8002;
    keepalive 16;
}

upstream dwd_gqc_copilot_server {
    server 127.0.0.1:8003;
    keepalive 16;
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name hydrotrek.org www.hydrotrek.org _;

    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name hydrotrek.org www.hydrotrek.org;

    ssl_certificate     /etc/ssl/hydrotrek/hydrotrek.org-fullchain.crt;
    ssl_certificate_key /etc/ssl/hydrotrek/hydrotrek.org.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    location /gqc/api/copilotkit/ {
        proxy_pass http://dwd_gqc_copilot_server/api/copilotkit/;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 300s;
        proxy_send_timeout 300s;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location = /gqc/api/copilotkit {
        proxy_pass http://dwd_gqc_copilot_server/api/copilotkit;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 300s;
        proxy_send_timeout 300s;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /gqc/api/mcp {
        proxy_pass http://dwd_gqc_mcp_fastmcp/mcp;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 300s;
        proxy_send_timeout 300s;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /gqc/api/fastapi/ {
        proxy_pass http://dwd_gqc_api_fastapi/;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 300s;
        proxy_send_timeout 300s;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location = /gqc/api/fastapi {
        return 301 /gqc/api/fastapi/;
    }

    location = / {
        return 404;
    }

    location / {
        return 404;
    }
}
