# WebSocket Upgrade 헤더 동적 처리 (Connection: upgrade ↔ close)
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen       80;
    server_name  _;
    root         /usr/share/nginx/html;
    index        index.html;

    # multipart 이미지 업로드 (Spring max-request-size 30MB와 맞춤)
    client_max_body_size 32m;

    # 외부 호스트명 DNS 조회용 resolver (Upbit + Backend 프록시에 필요)
    resolver 127.0.0.11 8.8.8.8 8.8.4.4 valid=30s;
    resolver_timeout 5s;

    # ── STOMP / SockJS (Spring context-path /api → /api/ws/trading) ───
    # SockJS 가 /api/ws/trading/{id}/{session}/websocket 으로 업그레이드하므로
    # 일반 REST 프록시와 분리해 Upgrade 헤더·장시간 타임아웃을 반드시 설정한다.
    location /api/ws/ {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade           $http_upgrade;
        proxy_set_header    Connection        $connection_upgrade;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 7d;
        proxy_send_timeout    7d;
        proxy_read_timeout    7d;
        proxy_buffering           off;
        proxy_request_buffering     off;
        gzip                        off;
        chunked_transfer_encoding   on;
    }

    # ── GoldenChart Spring Boot Backend 프록시 ────────────────────────
    # 브라우저 → /api/... → http://backend:8080/api/...
    location /api/ {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade           $http_upgrade;
        proxy_set_header    Connection        $connection_upgrade;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 10s;
        proxy_read_timeout    60s;
        proxy_send_timeout    60s;
        proxy_buffering       off;
    }

    # ── Upbit REST API 역방향 프록시 ──────────────────────────────────────
    # 브라우저 → /upbit-api/v1/... → https://api.upbit.com/v1/...
    # CORS 없이 동일 오리진 요청으로 처리됨 (dev: Vite proxy, prod: nginx proxy)
    location /upbit-api/ {
        proxy_pass          https://api.upbit.com/;
        proxy_ssl_server_name on;
        proxy_ssl_protocols   TLSv1.2 TLSv1.3;
        proxy_set_header    Host api.upbit.com;
        proxy_set_header    Accept application/json;
        proxy_set_header    X-Real-IP $remote_addr;
        proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_hide_header   Access-Control-Allow-Origin;
        add_header          Access-Control-Allow-Origin *;
        proxy_cache_bypass  $http_upgrade;
    }

    # ── Upbit WebSocket 역방향 프록시 ─────────────────────────────────────
    # 브라우저 → ws://HOST/upbit-ws → wss://api.upbit.com/websocket/v1
    location /upbit-ws {
        proxy_pass          https://api.upbit.com/websocket/v1;
        proxy_http_version  1.1;
        proxy_ssl_server_name on;
        proxy_ssl_protocols   TLSv1.2 TLSv1.3;
        proxy_ssl_verify      off;
        proxy_set_header    Upgrade $http_upgrade;
        proxy_set_header    Connection "Upgrade";
        proxy_set_header    Host api.upbit.com;
        proxy_set_header    Origin "https://upbit.com";
        proxy_set_header    X-Real-IP $remote_addr;
        # 쿠키/Authorization 헤더 제거 (업비트 WebSocket 인증 불필요)
        proxy_set_header    Authorization "";
        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
        proxy_buffering     off;
    }

    # ── STOMP / SockJS WebSocket 프록시 ──────────────────────────────────
    # Spring context-path /api → 실제 엔드포인트는 /api/ws/trading
    # (구버전 클라이언트 /ws/** 요청도 /api/ws/** 로 전달)
    location /ws/ {
        proxy_pass          http://backend:8080/api/ws/;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade    $http_upgrade;
        proxy_set_header    Connection $connection_upgrade;
        proxy_set_header    Host             $host;
        proxy_set_header    X-Real-IP        $remote_addr;
        proxy_set_header    X-Forwarded-For  $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_connect_timeout 7d;
        proxy_send_timeout    7d;
        proxy_read_timeout    7d;
        proxy_buffering       off;
    }

    # ── 모바일 APK 다운로드 (대용량) ─────────────────────────────────────
    location /api/mobile-app/download/ {
        proxy_pass          http://backend:8080;
        proxy_http_version  1.1;
        proxy_set_header    Host              $host;
        proxy_set_header    X-Real-IP         $remote_addr;
        proxy_set_header    X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto $scheme;
        proxy_read_timeout    600s;
        proxy_send_timeout    600s;
        proxy_buffering       off;
        client_max_body_size  200m;
    }

    # ── React SPA 폴백 ────────────────────────────────────────────────────
    location / {
        try_files $uri $uri/ /index.html;
    }

    # JS/CSS/이미지 등 정적 자산 — 1년 장기 캐시 (Vite 콘텐츠 해시 포함 파일명)
    location ~* \.(js|css|woff2?|ttf|eot|svg|ico|png|jpg|jpeg|gif|webp)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # HTML 은 캐시 안 함 (항상 최신 index.html 로드)
    location ~* \.html$ {
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    # GoldenChart Desktop updater manifest + bundles
    location /desktop/updates/ {
        alias /usr/share/nginx/html/desktop/updates/;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }
    location = /desktop/updates/latest.json {
        alias /usr/share/nginx/html/desktop/updates/latest.json;
        default_type application/json;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    # gzip 압축
    gzip            on;
    gzip_vary       on;
    gzip_min_length 1024;
    gzip_types      text/plain text/css text/javascript application/javascript
                    application/json image/svg+xml;
}