worker_processes auto;
worker_rlimit_nofile 65535;

events {
  multi_accept on;
  worker_connections 65535;
  use epoll;
}

http {
  charset utf-8;
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;
  server_tokens off;
  log_not_found off;
  types_hash_max_size 2048;
  client_max_body_size 100M;

  include mime.types;
  default_type application/octet-stream;

  access_log /var/log/nginx/access.log combined buffer=512k flush=1m;
  error_log /var/log/nginx/error.log warn;

  keepalive_timeout 65;
  keepalive_requests 100;
  client_body_timeout 60;
  client_header_timeout 60;
  send_timeout 60;

  # Gzip compression
  gzip on;
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 6;
  gzip_min_length 256;
  gzip_types
    application/javascript
    application/json
    application/manifest+json
    application/xml
    image/svg+xml
    text/css
    text/javascript
    text/plain
    text/xml;

  # Cache static assets with hashed filenames
  location ~* \.(?:css|js|map|json)$ {
    root /usr/share/nginx/html;
    expires 1y;
    access_log off;
    add_header Cache-Control "public, immutable, max-age=31536000";
  }

  location ~* \.(?:gif|jpe?g|png|webp|avif|ico|svg|woff2?|eot|ttf|otf)$ {
    root /usr/share/nginx/html;
    expires 1y;
    access_log off;
    add_header Cache-Control "public, immutable, max-age=31536000";
  }

  # Security headers
  add_header X-Frame-Options "DENY" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
  add_header X-XSS-Protection "1; mode=block" always;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
  add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;

  # API proxy
  location /api/ {
    proxy_pass http://api:3001/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_read_timeout 90;
    proxy_buffering off;
  }

  location /graphql {
    proxy_pass http://api:3001/graphql;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 90;
    proxy_buffering off;
  }

  # SPA fallback
  root /usr/share/nginx/html;
  index index.html;

  location / {
    try_files $uri $uri/ /index.html;
  }

  location ~ /\. {
    deny all;
    access_log off;
    log_not_found off;
  }

  location ~ ^/(\.env|\.git|node_modules|dist) {
    deny all;
    access_log off;
    log_not_found off;
  }
}