nginx.dev.conf

# VisionFlow Development Nginx Configuration
# Provides unified entry point on port 3001 for all services

pid /var/run/nginx.pid;
error_log /var/log/nginx/error.log crit;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    charset utf-8;

    # Custom MIME types for development
    # 'ts' and 'js' are removed as they are often predefined, causing warnings.
    types {
        text/jsx jsx;
        text/tsx tsx;
    }

    # Logging
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /var/log/nginx/access.log main;

    # Performance
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    client_max_body_size 100M;

    # WebSocket upgrade mapping
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    # Upstream services
    upstream rust_backend {
        server 127.0.0.1:4000;
        keepalive 32;
    }

    upstream vite_frontend {
        server 127.0.0.1:5173;
        keepalive 32;
    }

    # Main server block - Development entry point
    server {
        listen 3001 default_server;
        server_name localhost;

        # Security headers for SharedArrayBuffer and cross-origin isolation
        add_header Cross-Origin-Opener-Policy "same-origin" always;
        add_header Cross-Origin-Embedder-Policy "require-corp" always;
        add_header X-Content-Type-Options "nosniff" always;

        # === BACKEND ROUTES ===
        
        # REST API endpoints
        location /api/ {
            proxy_pass http://rust_backend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            
            # Timeouts for long-running operations
            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
            
            # Disable buffering for SSE/streaming responses
            proxy_buffering off;
            proxy_cache off;
        }

        # WebSocket endpoint for graph data
        location /wss {
            proxy_pass http://rust_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            
            # Long timeout for persistent connections
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            
            # Disable buffering for real-time data
            proxy_buffering off;
            tcp_nodelay on;
        }

        # WebSocket endpoint for speech services
        location /ws/speech {
            proxy_pass http://rust_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            
            # Long timeout for persistent connections
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            
            # Disable buffering for real-time data
            proxy_buffering off;
            tcp_nodelay on;
        }

        # WebSocket endpoint for MCP relay
        location /ws/mcp-relay {
            proxy_pass http://rust_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            
            # Long timeout for persistent connections
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            
            # Disable buffering for real-time data
            proxy_buffering off;
            tcp_nodelay on;
        }

        # === SOLID PROTOCOL ENDPOINTS → Rust backend (pod mgmt + LDP proxy to JSS) ===

        # Solid WebSocket notifications
        location /solid/.notifications {
            proxy_pass http://rust_backend/api/solid/.notifications;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header Authorization $http_authorization;

            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_connect_timeout 10s;
            proxy_buffering off;
            proxy_cache off;
        }

        # All /solid/* → Rust backend at /api/solid/* (pod management + LDP proxy to JSS)
        location /solid/ {
            proxy_pass http://rust_backend/api/solid/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header Authorization $http_authorization;
            proxy_set_header X-Forwarded-URI $request_uri;

            proxy_pass_header Accept;
            proxy_pass_header Content-Type;
            proxy_pass_header Link;
            proxy_pass_header Slug;
            proxy_pass_header If-Match;
            proxy_pass_header If-None-Match;

            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
            proxy_connect_timeout 10s;

            client_max_body_size 50m;
        }

        # User pods shortcut → Rust backend at /api/solid/pods/
        location /pods/ {
            proxy_pass http://rust_backend/api/solid/pods/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header Authorization $http_authorization;

            proxy_pass_header Accept;
            proxy_pass_header Content-Type;
            proxy_pass_header Link;
            proxy_pass_header Slug;

            client_max_body_size 50m;
        }

        # === COPYPARTY FILE BROWSER ===

        location = /browser-test {
            return 200 "COPYPARTY ROUTE WORKS\n";
            add_header Content-Type text/plain;
        }

        location ^~ /browser/ {
            rewrite ^/browser/(.*) /$1 break;
            proxy_pass http://172.18.0.4:3923/;

            # WebSocket support
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;

            # Standard reverse proxy headers
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Disable buffering for better streaming performance
            proxy_buffering off;
            proxy_request_buffering off;

            # Timeouts for long uploads
            proxy_connect_timeout 3600s;
            proxy_send_timeout 3600s;
            proxy_read_timeout 3600s;
            send_timeout 3600s;

            # Allow large file uploads
            client_max_body_size 0;
        }

        location = /browser {
            return 301 /browser/;
        }

        # === VITE DEV SERVER ROUTES ===

        # WebSocket for Vite HMR (Hot Module Replacement)
        location /vite-hmr {
            proxy_pass http://vite_frontend; # Pass to the vite_frontend upstream
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_read_timeout 3600s; # Keep connection open
        }

        # Vite special endpoints
        location ~ ^/(\.vite|node_modules|@vite|@react-refresh|@id|@fs|src) {
            proxy_pass http://vite_frontend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            
            # Cache control for development
            add_header Cache-Control "no-cache, no-store, must-revalidate";
            add_header Pragma "no-cache";
            add_header Expires "0";
        }

        # Static assets with proper MIME types
        location ~* \.(js|jsx|ts|tsx|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
            proxy_pass http://vite_frontend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            
            # Development cache headers
            add_header Cache-Control "no-cache, must-revalidate";
        }

        # Root - Frontend application (must be last)
        location / {
            proxy_pass http://vite_frontend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            
            # Support for client-side routing
            proxy_intercept_errors on;
            error_page 404 = @vite_fallback;
        }

        # Fallback for client-side routing
        location @vite_fallback {
            # Rewrite the request to the root index.html for the SPA.
            # This is the correct way to handle proxy_pass in a named location.
            rewrite ^ /index.html break;
            proxy_pass http://vite_frontend;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        # Health check endpoint
        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }
}