# Webmail front door: static SPA + reverse proxy to the API container.
#
# This file is dropped into /etc/nginx/conf.d/, i.e. it is already inside the
# `http` block — hence the bare `map` below.

# Preserve the original scheme when something else terminates TLS in front of us
# (Synology's Login Portal reverse proxy, QNAP's, Caddy, Cloudflare Tunnel...).
# The API only emits Secure/__Host- cookies when it believes the request was
# https, so losing this header silently downgrades session cookies.
map $http_x_forwarded_proto $fwd_proto {
    default $scheme;
    https   https;
    http    http;
}

# Connection header for the WebSocket upgrade dance on /api/ws.
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

upstream webmail_api {
    server api:8000;
    keepalive 16;
}

server {
    listen 80;
    server_name _;

    root /usr/share/nginx/html;
    index index.html;

    # Attachment uploads. Keep this comfortably above MAX_ATTACHMENT_MB (default
    # 25) to leave room for multipart/base64 overhead.
    client_max_body_size 64m;
    client_body_timeout 300s;

    # The NAS is doing other jobs too — don't buffer big uploads to disk twice.
    proxy_request_buffering off;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/javascript application/json
               image/svg+xml application/manifest+json;

    # Clickjacking / sniffing basics. The app's own CSP for mail HTML is applied
    # server-side in app/indexer/sanitize.py; this is only the shell document.
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy no-referrer always;

    # ---- API ----------------------------------------------------------------
    location /api/ {
        proxy_pass http://webmail_api;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $fwd_proto;
        proxy_set_header X-Forwarded-Host  $host;

        # WebSocket (/api/ws) and any long-poll: no upgrade means no live mail.
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # Live updates hold the connection open; don't cut them at 60 s.
        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
        proxy_buffering off;
    }

    # ---- static -------------------------------------------------------------
    # Vite emits content-hashed filenames into /assets, so they are immutable.
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    location /fonts/ {
        expires 30d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    location = /healthz {
        access_log off;
        return 200 "ok\n";
        add_header Content-Type text/plain;
    }

    # SPA fallback: every non-file route renders index.html (react-router).
    location / {
        try_files $uri $uri/ /index.html;
    }

    # index.html itself must never be cached, or a deploy won't be picked up.
    location = /index.html {
        add_header Cache-Control "no-store, must-revalidate";
    }
}