# proxy-vm/nginx/nginx.conf
worker_processes auto;
error_log /dev/stderr warn;
pid /tmp/nginx.pid;

events {
    worker_connections 1024;
}

http {
    # --- JSON access log ---
    log_format json_log escape=json
        '{'
            '"time":"$time_iso8601",'
            '"remote_addr":"$remote_addr",'
            '"method":"$request_method",'
            '"uri":"$request_uri",'
            '"status":$status,'
            '"bytes_sent":$bytes_sent,'
            '"request_time":$request_time,'
            '"upstream_addr":"$upstream_addr",'
            '"upstream_response_time":"$upstream_response_time"'
        '}';

    access_log /dev/stdout json_log;

    # --- Hash bucket size for long map keys (PROXY_SECRET) ---
    map_hash_bucket_size 128;

    # --- Performance ---
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    client_max_body_size 50m;
    gzip off;

    # --- DNS resolver (Google + Cloudflare, re-resolve every 30s) ---
    resolver 8.8.8.8 1.1.1.1 valid=30s ipv6=off;
    resolver_timeout 5s;

    # --- IP allowlist (generated at container start) ---
    include /etc/nginx/conf.d/allowlist.conf;

    # --- Token auth ---
    include /etc/nginx/conf.d/auth.conf;

    # --- HTTP server ---
    server {
        listen 8080;
        server_name _;
        include /etc/nginx/conf.d/locations.conf;
    }

    # --- HTTPS server (generated at container start if certs exist) ---
    include /etc/nginx/conf.d/https_server.conf;
}