# External Nginx reverse proxy for publishing SkillHub under:
#   http://ipd.abc.com/skillhub
#
# Assumptions:
# - SkillHub web is exposed on localhost:18080
# - SkillHub API/server is exposed on localhost:18081
# - .env.release sets:
#     SKILLHUB_PUBLIC_BASE_URL=http://ipd.abc.com/skillhub
#     SKILLHUB_WEB_API_BASE_URL=/skillhub/api
#     WEB_PORT=18080
#     API_PORT=18081
#
# Put this file in /etc/nginx/conf.d/skillhub.conf, then run:
#   nginx -t && systemctl reload nginx

server {
    listen 80;
    server_name ipd.abc.com;

    client_max_body_size 100M;

    # Normalize the prefix.
    location = /skillhub {
        return 301 /skillhub/;
    }

    # Frontend SPA under /skillhub.
    # The internal SkillHub web container is built for /, so strip /skillhub.
    location /skillhub/ {
        proxy_pass http://127.0.0.1:18080/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Prefix /skillhub;
    }

    # Browser runtime config and static assets.
    # SkillHub v0.2.8 emits absolute /assets and /runtime-config.js paths.
    location /assets/ {
        proxy_pass http://127.0.0.1:18080/assets/;
        proxy_set_header Host $host;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    location = /favicon.svg {
        proxy_pass http://127.0.0.1:18080/favicon.svg;
        proxy_set_header Host $host;
    }

    location = /runtime-config.js {
        proxy_pass http://127.0.0.1:18080/runtime-config.js;
        proxy_set_header Host $host;
        add_header Cache-Control "no-store";
    }

    location = /registry/skill.md {
        proxy_pass http://127.0.0.1:18080/registry/skill.md;
        proxy_set_header Host $host;
    }

    # API through the /skillhub prefix. This is what the frontend should use.
    location /skillhub/api/ {
        proxy_pass http://127.0.0.1:18081/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Prefix /skillhub;
    }

    # OAuth and device/browser auth callback paths if OAuth is enabled later.
    location /skillhub/oauth2/ {
        proxy_pass http://127.0.0.1:18081/oauth2/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Prefix /skillhub;
    }

    location /skillhub/login/oauth2/ {
        proxy_pass http://127.0.0.1:18081/login/oauth2/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Prefix /skillhub;
    }

    location /skillhub/.well-known/ {
        proxy_pass http://127.0.0.1:18081/.well-known/;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Prefix /skillhub;
    }

    # Optional: allow CLI/API clients to use http://ipd.abc.com/skillhub
    # as CLAWHUB_REGISTRY. The CLI appends /api/... to the registry URL.
    location = /skillhub/actuator/health {
        proxy_pass http://127.0.0.1:18081/actuator/health;
        proxy_set_header Host $host;
    }
}
