nginx.conf

# Use a standard, writable path for the PID file
pid /tmp/nginx.pid;
error_log /var/log/nginx/error.log debug;

events {
    worker_connections 1024;
    multi_accept on;
    use epoll;
}

http {
    # Basic settings
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    charset utf-8;

    # Override TypeScript MIME type (overriding video/mp2t from mime.types)
    types {
        application/typescript ts;
    }

    # Logging
    log_format debug_format '$remote_addr - $remote_user [$time_local] '
                          '"$request" $status $body_bytes_sent '
                          '"$http_referer" "$http_user_agent" '
                          'rt=$request_time uct="$upstream_connect_time" uht="$upstream_header_time" urt="$upstream_response_time"'
                          ' ws_status="$upstream_http_upgrade"';  # Added WebSocket status logging

    access_log /var/log/nginx/access.log debug_format;

    # Optimization
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 120;  # Increased to match cloudflared keepAliveTimeout
    keepalive_requests 100;

    # Gzip settings
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    # WebSocket configuration
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    # Upstream backend definition for the Rust server
    upstream backend {
        server 127.0.0.1:3001;  # Use localhost since both services are in same container
        keepalive 32;  # Keep connections alive
    }

    # Main server configuration
    server {
        listen 4000 default_server;  # Listen on port 4000 for external connections
        server_name _;  # Accept any server name
        root /app/client/dist;  # Set root to built client files directory

        # Security headers
        add_header Cross-Origin-Opener-Policy "same-origin" always;
        add_header Cross-Origin-Embedder-Policy "require-corp" always;
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-XSS-Protection "1; mode=block";
        add_header Referrer-Policy "same-origin" always;
        add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src 'self' ws: wss: http: https: *.visionflow.info; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://getalby.com; frame-src 'self' https://getalby.com" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        # WebSocket endpoint
        location /wss {
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;

            # Pass through Cloudflare headers
            proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
            proxy_set_header CF-Ray $http_cf_ray;
            proxy_set_header CF-Visitor $http_cf_visitor;

            # Standard proxy headers
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;

            # WebSocket timeouts
            proxy_read_timeout 600m;  # Increased from 3600s to 600m (10 hours) to match websocketIdleTimeout
            proxy_send_timeout 3600s;
            proxy_connect_timeout 75s;
            proxy_buffering off;
            proxy_cache off;

            # Debug logging
            access_log /var/log/nginx/websocket.log debug_format;
            error_log /var/log/nginx/websocket-error.log debug;
        }

        # Voice WebSocket endpoint
        location /ws/speech {
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;

            # Pass through Cloudflare headers
            proxy_set_header CF-Connecting-IP $http_cf_connecting_ip;
            proxy_set_header CF-Ray $http_cf_ray;
            proxy_set_header CF-Visitor $http_cf_visitor;

            # Standard proxy headers
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;

            # WebSocket timeouts
            proxy_read_timeout 600m;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 75s;
            proxy_buffering off;
            proxy_cache off;

            # Debug logging
            access_log /var/log/nginx/websocket.log debug_format;
            error_log /var/log/nginx/websocket-error.log debug;
        }

        # API endpoints
        location /api {
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # API specific settings
            proxy_read_timeout 120s;  # Increased for larger graph data
            proxy_send_timeout 120s;  # Increased for larger graph data
            proxy_connect_timeout 60s;
            proxy_buffering on;       # Enable buffering for API responses
            proxy_buffer_size 256k;   # Increased for larger responses
            proxy_buffers 8 256k;     # Increased number of buffers
            proxy_busy_buffers_size 512k;  # Increased for larger responses
            proxy_max_temp_file_size 2048m;  # Allow larger temporary files
            add_header Cache-Control "no-store" always;  # Prevent caching of dynamic data
        }

        # Static files
        location / {
            try_files $uri $uri/ /index.html =404;
            expires 1h;
            add_header Cache-Control "public, no-transform";
            # error_page 404 = @backend;  # Remove fallback for root, let try_files handle index.html
        }

        # Static files with proper MIME types
        location /assets/ {
            expires 7d;
            add_header Cache-Control "public, no-transform" always;
            try_files $uri =404;
            access_log off;
        }

        # Fallback location for static files
        location @backend {
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Error pages
        error_page 404 /404.html;
        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
            root /usr/share/nginx/html;
        }
    }
}