# /etc/nginx/sites-available/musehub
#
# Cloudflare Origin Certificate configuration.
# Cloudflare terminates SSL at the edge. This nginx instance accepts HTTPS
# connections using a Cloudflare Origin Certificate.
#
# SSL mode in Cloudflare dashboard MUST be set to "Full (Strict)".
# No Certbot or Let's Encrypt required — the Origin Certificate is valid for 15 years.
#
# IP restriction is enforced at the EC2 security group level (inbound port 443
# restricted to Cloudflare IP ranges). Do not duplicate that logic here —
# the real_ip module replaces $remote_addr with the true client IP before
# allow/deny runs, which would incorrectly block legitimate Cloudflare traffic.
#
# To generate the Origin Certificate:
#   Cloudflare Dashboard → <domain> → SSL/TLS → Origin Server → Create Certificate
#   Choose "Generate private key and CSR with Cloudflare" → RSA (2048) → 15 years
#   Save certificate  → /etc/ssl/cloudflare/origin.pem
#   Save private key  → /etc/ssl/cloudflare/origin.key
#   chmod 640 /etc/ssl/cloudflare/origin.key

# Restore the real client IP from the Cloudflare connecting-IP header.
# Without this, every request appears to come from a Cloudflare edge node.
# Cloudflare IP ranges: https://www.cloudflare.com/ips/
real_ip_header     CF-Connecting-IP;
real_ip_recursive  on;

# Cloudflare IPv4 ranges
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;

# Cloudflare IPv6 ranges
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;

# Blue-green upstream: deploy.sh rewrites /etc/nginx/musehub-active-port
# and runs `nginx -s reload` to switch slots atomically.
upstream musehub_backend {
    include /etc/nginx/musehub-active-port;
}

# Redirect all plain-HTTP traffic to HTTPS — 301 (permanent, cacheable).
# In prod, Cloudflare enforces HTTPS at the edge, so this only fires for
# traffic that bypasses Cloudflare (e.g., direct-to-origin access during
# ops or monitoring). Belt-and-suspenders.
server {
    listen 80;
    listen [::]:80;
    server_name DOMAIN_PLACEHOLDER;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name DOMAIN_PLACEHOLDER;

    ssl_certificate     /etc/ssl/cloudflare/origin.pem;
    ssl_certificate_key /etc/ssl/cloudflare/origin.key;

    # Enforce TLS 1.2 minimum — disable TLS 1.0 and TLS 1.1 (both deprecated).
    # TLS 1.3 is preferred; 1.2 retained for compatibility with older clients.
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;  # TLS 1.3 ignores this; keep off for 1.2 forward secrecy

    client_max_body_size 500m;

    gzip                on;
    gzip_comp_level     5;
    gzip_vary           on;
    gzip_types          text/plain text/css text/javascript application/javascript
                        application/json application/x-msgpack
                        application/x-muse-mpack application/x-muse-wire;

    # Push endpoints — plain HTTPS POST, no gRPC.
    # /push/stream  — MWP pack upload (Content-Type: application/x-muse-wire).
    # /push/objects — presigned URL requests.
    # /push         — legacy path.
    # Buffering disabled: large packs must stream directly to hypercorn without
    # nginx buffering the request body in memory/disk first.
    # client_max_body_size 0: no body size cap — repos can be arbitrarily large.
    location ~ ^/[^/]+/[^/]+/push(/stream|/objects)?$ {
        proxy_pass                  http://musehub_backend;
        proxy_http_version          1.1;
        proxy_set_header            Host              $host;
        proxy_set_header            X-Real-IP         $remote_addr;
        proxy_set_header            X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header            X-Forwarded-Proto $scheme;
        proxy_read_timeout          300s;
        proxy_send_timeout          300s;
        proxy_request_buffering     off;
        proxy_buffering             off;
        client_max_body_size        0;
    }

    # Fetch endpoints — standard HTTP/1.1 proxy.
    # /fetch is Phase 1 (commits + snapshots metadata).
    # /fetch/objects is Phase 2 (raw object bytes for checkout).
    location ~ ^/[^/]+/[^/]+/fetch(/objects)?$ {
        proxy_pass         http://musehub_backend;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 300s;
    }

    # Proxy all other traffic to the MuseHub hypercorn container
    location / {
        proxy_pass         http://musehub_backend;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
    }
}