# ============================================================
# noctualabs.tech — Axiom Zero Reverse Proxy Configuration
# Place this in /etc/nginx/sites-available/noctualabs-api
# Then: sudo ln -s /etc/nginx/sites-available/noctualabs-api \
#                  /etc/nginx/sites-enabled/
#       sudo certbot --nginx -d api.noctualabs.tech
#       sudo nginx -t && sudo systemctl reload nginx
# ============================================================

# Redirect HTTP → HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name api.noctualabs.tech noctualabs.tech www.noctualabs.tech;

    # Let's Encrypt ACME challenge (certbot uses this automatically)
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# Main HTTPS API server — proxies to Pi 5 via SSH reverse tunnel
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name api.noctualabs.tech;

    # SSL — managed by certbot (auto-renewed every 90 days for free)
    ssl_certificate     /etc/letsencrypt/live/api.noctualabs.tech/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.noctualabs.tech/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # Security headers — makes response headers look datacenter-professional
    server_tokens off;
    add_header X-Content-Type-Options    "nosniff"          always;
    add_header X-Frame-Options           "DENY"             always;
    add_header X-XSS-Protection          "1; mode=block"    always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Powered-By              "Axiom Zero v5.0"  always;
    add_header Server                    "NoctuaEdge/1.0"   always;

    # Rate limiting (protect Pi 5 from abuse)
    limit_req_zone $binary_remote_addr zone=scoring:10m rate=50r/s;

    # ── Scoring API ─────────────────────────────────────────
    location /v1/ {
        limit_req zone=scoring burst=200 nodelay;
        proxy_pass         http://127.0.0.1:9085;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_connect_timeout 5s;
        proxy_read_timeout    30s;
        proxy_send_timeout    30s;
    }

    # ── Developer / Telemetry API ────────────────────────────
    location /api/ {
        proxy_pass         http://127.0.0.1:9085;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_connect_timeout 5s;
        proxy_read_timeout    60s;
    }

    # ── Public Key / JWK Endpoint ───────────────────────────
    location /.well-known/ {
        proxy_pass http://127.0.0.1:9085;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        add_header Cache-Control "public, max-age=3600";
    }

    # ── Axiom JS SDK — served & cached directly from web server ──
    # Copy axiom.min.js to /var/www/html/sdk/ on noctualabs.tech
    # Customers get full server bandwidth, not Pi 5's 40 Mbps.
    location /sdk/ {
        root /var/www/html;
        add_header Cache-Control "public, max-age=86400";
        add_header Access-Control-Allow-Origin "*";
        gzip_static on;
    }

    # ── Web Control Panel (optional: serve portal from web server) ──
    location /portal/ {
        root /var/www/html;
        try_files $uri $uri/ =404;
    }

    # ── Health check endpoint (served by nginx, no Pi 5 required) ──
    location /health {
        return 200 '{"status":"ok","service":"Axiom Zero Edge","version":"5.0"}';
        add_header Content-Type application/json;
    }
}

# Optional: Customer-facing main site on noctualabs.tech
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name noctualabs.tech www.noctualabs.tech;

    ssl_certificate     /etc/letsencrypt/live/noctualabs.tech/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/noctualabs.tech/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    server_tokens off;

    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}
