# /etc/nginx/sites-available/your-api

# Rate limit zones
limit_req_zone $binary_remote_addr zone=ip_limit:10m rate=100r/h;

# Upstream backend servers
upstream backend {
    server localhost:8000;
    # Nếu có nhiều backend servers:
    # server localhost:8001;
    # server localhost:8002;
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name api.yourdomain.com;
    
    # Redirect to HTTPS
    return 301 https://$server_name$request_uri;
}

# Main HTTPS server
server {
    listen 443 ssl http2;
    server_name api.yourdomain.com;
    
    # SSL certificates (Let's Encrypt)
    ssl_certificate /etc/letsencrypt/live/api.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.yourdomain.com/privkey.pem;
    
    # SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    # Security headers
    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    
    # Logging
    access_log /var/log/nginx/api_access.log;
    error_log /var/log/nginx/api_error.log;
    
    # Main API endpoint
    location /api/ {
        # Rate limiting (100 requests/hour per IP)
        limit_req zone=ip_limit burst=20 nodelay;
        limit_req_status 429;
        
        # CORS headers (if needed)
        add_header 'Access-Control-Allow-Origin' '*' always;
        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;
        add_header 'Access-Control-Allow-Headers' 'Authorization, Content-Type, X-Anonymous-ID' always;
        
        # Handle preflight
        if ($request_method = 'OPTIONS') {
            return 204;
        }
        
        # Proxy to backend
        proxy_pass http://backend;
        
        # Pass headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Pass auth headers
        proxy_set_header Authorization $http_authorization;
        proxy_set_header X-Anonymous-ID $http_x_anonymous_id;
        
        # Timeouts
        proxy_connect_timeout 60s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
        
        # Buffer settings
        proxy_buffering off;
        proxy_request_buffering off;
    }
    
    # Health check endpoint (không rate limit)
    location /health {
        access_log off;
        proxy_pass http://backend/health;
    }
    
    # Custom error pages
    error_page 429 /429.json;
    location = /429.json {
        internal;
        return 429 '{"error":"Too many requests. Please try again later.","retry_after":3600}';
        add_header Content-Type application/json always;
        add_header Retry-After 3600 always;
    }
    
    error_page 502 503 504 /50x.json;
    location = /50x.json {
        internal;
        return 502 '{"error":"Service temporarily unavailable"}';
        add_header Content-Type application/json always;
    }
}