# Same-origin API for the SPA: REST under /api, GraphQL (HTTP + WebSocket) under /graphql.
# The API is reached by its unique alias (task-stream-api), not by the service name `api`:
# on a shared network (Dokploy) another project's `api` would get half of the requests.
map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

server {
  listen 80;
  root /usr/share/nginx/html;

  location /api/ {
    # Attachments: the API takes files up to ATTACHMENTS_MAX_MB (25 MB by default).
    client_max_body_size 30m;
    proxy_pass http://task-stream-api:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }

  location /graphql {
    proxy_pass http://task-stream-api:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $host;
    # Subscriptions keep the socket open.
    proxy_read_timeout 1h;
  }

  # The service worker and the manifest have no hash in their name: never
  # cached, or browsers would keep an old one (exact matches win over the
  # regex below).
  location = /push-sw.js {
    add_header Cache-Control "no-cache";
    try_files $uri =404;
  }
  location = /manifest.webmanifest {
    add_header Cache-Control "no-cache";
    default_type application/manifest+json;
    try_files $uri =404;
  }

  # Hashed bundles can be cached forever; index.html never.
  location ~* \.(js|css|woff2?|svg|png|ico)$ {
    expires 1y;
    add_header Cache-Control "public, immutable";
    try_files $uri =404;
  }

  location / {
    add_header Cache-Control "no-cache";
    try_files $uri $uri/ /index.html;
  }
}