# Write Server Nginx 站点配置
# 反向代理配置 + Basic Auth 认证

server {
    listen 80;
    server_name _;  # 匹配所有域名和 IP

    # 日志
    access_log /var/log/nginx/write-server-access.log;
    error_log /var/log/nginx/write-server-error.log;

    # Basic Auth 认证（保护管理后台）
    auth_basic "Write Server Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;

    # 健康检查（不需要认证）
    location /health {
        auth_basic off;
        proxy_pass http://write-server:8016/api/stats;
        access_log off;
    }

    # 代理到 Write Server
    location / {
        proxy_pass http://write-server:8016;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;

        # 超时设置
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 120s;
        client_max_body_size 50m;
    }

    # 禁止访问隐藏文件
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
}