worker_processes 1;

events { worker_connections 1024; }

# RTMP Server for live streaming and transcoding
rtmp {
    server {
        listen 1935;
        chunk_size 4096;
        drop_idle_publisher 30s; # Drop inactive streams after 30 seconds

        application live {
            live on;
            record off; # Can be turned on to record streams

            # Enable HLS transcoding
            hls on;
            hls_path /tmp/hls; # Path inside the nginx container for HLS files
            hls_fragment 3s;
            hls_playlist_length 60s;
        }
    }
}

http {
  # HTTP Server: Redirect all traffic to HTTPS
  server {
    listen 80;
    server_name _; # Catches all hostnames
    return 301 https://$host$request_uri;
  }

  # HTTPS Server
  server {
    listen 443 ssl;
    server_name _; # Catches all hostnames

    # SSL Certificate Configuration
    # IMPORTANT: These filenames must match your uploaded files.
    ssl_certificate /etc/nginx/certs/cert_71665.pem;
    ssl_certificate_key /etc/nginx/certs/cert_71665_key.pem;

    # SSL settings for modern security
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY_1305_SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;

    location / {
      proxy_pass http://next-app:3000;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_cache_bypass $http_upgrade;
    }

    # Location to serve the HLS files
    location /hls {
        types {
            application/vnd.apple.mpegurl m3u8;
            video/mp2t ts;
        }
        root /tmp;
        add_header Cache-Control no-cache;
        
        # More robust CORS headers to allow browser playback
        add_header 'Access-Control-Allow-Origin' '*' always;
        add_header 'Access-Control-Allow-Methods' 'GET, HEAD, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;
        add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;

        if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Methods' 'GET, HEAD, OPTIONS';
            add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain; charset=utf-8';
            add_header 'Content-Length' 0;
            return 204;
        }
    }

    # RTMP Statistics Endpoint
    location /stat {
        # This endpoint is internal to the proxy network
        # and will be fetched by the Next.js server, not the client.
        # This avoids exposing it publicly.
        proxy_pass http://next-app:3000/api/rtmp-stat;
    }

    location /genkit/ {
      proxy_pass http://genkit-service:9999/;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_cache_bypass $http_upgrade;
    }
  }
}