user  nginx;
worker_processes  auto;
error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;

events {
  worker_connections  1024;
}

http {
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;
  sendfile      on;
  keepalive_timeout  65;

  # 访问日志（含握手关键头，用于排查）
  log_format dbg '$remote_addr "$request" $status '
                 'cliUpg:$http_upgrade cliConn:$http_connection '
                 'upUpg:$upstream_http_upgrade upConn:$upstream_http_connection';
  access_log /var/log/nginx/access.log dbg;

  # ---- 动态设置 Connection，只有在有 Upgrade 时才 upgrade，否则 close
  map $http_upgrade $connection_upgrade {
      default upgrade;
      ''      close;
  }

  # 上游后端定义
  upstream picture_backend {
    server smile-picture-backend:8096;
    keepalive 32;
  }

  # -------------------- 80 端口：可选，统一跳转到 HTTPS --------------------
  server {
      listen       80;
      server_name  picture.bitday.top _;
      return 301 https://$host$request_uri;
  }

  # -------------------- 443 端口：HTTPS + WebSocket 透传 --------------------
  server {
      listen              443 ssl http2;
      server_name         picture.bitday.top _;

      # 替换为你的证书路径
      ssl_certificate     /etc/ssl/certs/your.crt;
      ssl_certificate_key /etc/ssl/private/your.key;

      # （可选）基础 SSL 设置
      ssl_session_cache   shared:SSL:10m;
      ssl_session_timeout 10m;

      root   /usr/share/nginx/html;
      index  index.html;

      # ---------- WebSocket 代理（放在 /api/ 之前） ----------
      location /api/ws/ {
          proxy_pass              http://picture_backend;
          proxy_http_version      1.1;

          # 关键：Upgrade / Connection 透传（动态）
          proxy_set_header        Upgrade            $http_upgrade;
          proxy_set_header        Connection         $connection_upgrade;

          # 透传常用头
          proxy_set_header        Host               $host;
          proxy_set_header        X-Real-IP          $remote_addr;
          proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
          proxy_set_header        X-Forwarded-Proto  $scheme;
          proxy_set_header        Origin             $http_origin;

          proxy_buffering         off;
          proxy_read_timeout      86400s;
          proxy_send_timeout      600s;
          proxy_connect_timeout   600s;

          # （可选）显式禁止缓存
          add_header              Cache-Control      "no-store" always;
      }

      # ---------- REST API 代理 ----------
      location /api/ {
          proxy_pass              http://picture_backend;

          proxy_set_header        Host               $host;
          proxy_set_header        X-Real-IP          $remote_addr;
          proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
          proxy_set_header        X-Forwarded-Proto  $scheme;

          client_max_body_size    10M;   # 允许上传 10MB
          proxy_connect_timeout   600s;
          proxy_send_timeout      600s;
          proxy_read_timeout      600s;
      }

      # ---------- 前端路由兼容（SPA） ----------
      location / {
          try_files $uri $uri/ /index.html;
      }
  }
}
