GMW/infra/nix/nginx.conf.template

events {}

http {
  include @NGINX_MIME@;

  access_log /var/lib/gmw-proxy/nginx-access.log;
  error_log /var/lib/gmw-proxy/nginx-error.log;

  map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
  }

  # Next.js standalone SSR server (backend-fetching on every render).
  # Not for hand-editing: @NEXT_PORT@ is substituted at build time.
  upstream gmw_next {
    server 127.0.0.1:@NEXT_PORT@;
    keepalive 16;
  }

  upstream gmw_backend {
    server 127.0.0.1:4001;
    keepalive 16;
  }

  server {
    listen 4009;
    server_name _;

    # Use relative redirects (Location: /dashboard/) instead of absolute
    # URLs that leak the internal listen port (4009) through the reverse proxy.
    absolute_redirect off;

    gzip on;
    gzip_types text/plain text/css application/json application/javascript application/wasm image/svg+xml;
    gzip_min_length 256;

    # ── Backend REST ───────────────────────────────────────────────
    location ^~ /api {
      proxy_pass http://gmw_backend$uri$is_args$args;
      proxy_http_version 1.1;
      proxy_set_header Connection "";   # keepalive to backend
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

    # ── Backend WebSocket (realtime shared state + voice PCM) ──────
    location ^~ /ws {
      proxy_pass http://gmw_backend$uri$is_args$args;
      proxy_http_version 1.1;
      proxy_set_header Upgrade              $http_upgrade;
      proxy_set_header Connection           $connection_upgrade;
      proxy_set_header Host                 $host;
      proxy_set_header X-Real-IP            $remote_addr;
      proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto    $scheme;
      proxy_buffering off;
      proxy_read_timeout 86400s;
      proxy_send_timeout 86400s;
    }

    # ── Next.js build assets — immutable, edge/shareable ───────────
    location ^~ /_next/static/ {
      proxy_pass http://gmw_next$uri$is_args$args;
      proxy_http_version 1.1;
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      expires 1y;
      add_header Cache-Control "public, immutable";
    }

    # ── Everything else → Next.js server (SSR) ──
    location / {
      proxy_pass http://gmw_next$uri$is_args$args;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Next-Prefetch  $http_x_next_prefetch;
      proxy_buffering off;
      proxy_read_timeout 30s;
    }
  }
}