server {
  listen 80;
  server_name _;

  charset utf-8;
  client_max_body_size 100m;

  # Docker 内置 DNS resolver + 变量化 proxy_pass：
  # nginx 对静态 proxy_pass 在启动时静态解析主机名，容器重建后 IP 变更即失效。
  # 改为变量写法后，resolver 每 10s 重新解析，容器重建无需重启/reload nginx。
  resolver 127.0.0.11 valid=10s ipv6=off;

  # 健康检查（宿主机 nginx 探活用）
  location /health {
    return 200 "ok\n";
    add_header Content-Type text/plain;
  }

  # 版本管理 — 必须在通用 /api/ 之前
  location /api/v1/updates/ {
    set $svc update-service;
    proxy_pass         http://$svc:8084;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 60s;
  }

  location /api/v1/rn/ {
    set $svc update-service;
    proxy_pass         http://$svc:8084;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 120s;
  }

  # IM HTTP — 必须在通用 /api/ 之前
  location /api/im/ {
    set $svc im-service;
    proxy_pass         http://$svc:8082;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 60s;
  }

  # IM WebSocket
  location /ws/im {
    set $svc im-service;
    proxy_pass         http://$svc:8082;
    proxy_http_version 1.1;
    proxy_set_header   Upgrade $http_upgrade;
    proxy_set_header   Connection "upgrade";
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_read_timeout 3600s;
  }

  # License — 必须在通用 /api/ 之前
  location /api/license/ {
    set $svc license-service;
    proxy_pass         http://$svc:8085;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 60s;
  }

  # 文件上传下载 — 必须在通用 /api/ 之前
  location /api/file/ {
    set $svc file-service;
    proxy_pass             http://$svc:8086;
    proxy_set_header       Host $host;
    proxy_set_header       X-Real-IP $remote_addr;
    proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
    client_max_body_size   500m;
    proxy_read_timeout     300s;
    proxy_send_timeout     300s;
  }

  # 核心 API（兜底，在所有具体 /api/xxx/ 之后）
  location /api/ {
    set $svc tenant-service;
    proxy_pass         http://$svc:9001;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 60s;
  }

  location /actuator/ {
    set $svc tenant-service;
    proxy_pass       http://$svc:9001;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
  }

  # 控制台前端（兜底路由，必须最后）
  # sub_filter 替换前端 JS bundle 中硬编码的公有平台地址为私有部署地址
  location / {
    set $svc tenant-web;
    proxy_pass       http://$svc:80;
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header Accept-Encoding   "";
    sub_filter 'wss://im.dev.xuqinmin.com/ws/im' 'wss://$host/ws/im';
    sub_filter 'https://im.dev.xuqinmin.com'      'https://$host';
    sub_filter 'https://dev.xuqinmin.com'          'https://$host';
    sub_filter_once  off;
    sub_filter_types text/html text/javascript application/javascript;
  }
}