#
# nginx for Solid Scribe on NixOS.
#
# Merge this into your configuration.nix and `nixos-rebuild switch`.
# Replace REPO_PATH with the absolute path of the repo clone on the server.
#
# Four things differ from the previous config, and the first two are required
# for the Vue 3 client to work at all:
#
#   1. SPA fallback. The old Vue 2 client used vue-router's default HASH mode
#      (no `mode:` was set), so every request was just "/" and routing happened
#      after the "#". That is why share links looked like /#/public/note/...
#      The Vue 3 client uses createWebHistory, so /notes, /settings and
#      /share-target are real HTTP requests. Without tryFiles they all 404.
#
#   2. root moves up to the vhost. It was inside locations."/", which left
#      /assets/, /sw.js and /manifest.json unresolvable once they needed their
#      own location blocks.
#
#   3. proxyWebsockets on /socket. recommendedProxySettings does NOT add the
#      Upgrade/Connection headers, so Socket.IO has been silently falling back
#      to long-polling -- that's the live note-sync path running degraded.
#
#   4. Cache headers. See the warning below.
#
# !! CLOUDFLARE !!
# The tunnel sits in front of this and Cloudflare caches .js by DEFAULT, which
# includes /sw.js. If the edge caches the service worker, the update check can
# never see a new one and the app is pinned to an old build with no remote way
# to recover. The nginx headers below are necessary but NOT sufficient --
# add a Cloudflare Cache Rule that BYPASSES cache for /sw.js (and /index.html)
# before cutting over.
#
# Also confirm which Host header cloudflared sends. This vhost is keyed on
# "192.168.1.7"; if the tunnel forwards the public hostname instead, nginx will
# not match this vhost and will fall through to the default server. Either add
# the public hostname to serverAliases or set the tunnel's httpHostHeader.
#

services.nginx = {
  enable = true;
  recommendedProxySettings = true;
  recommendedGzipSettings = true;

  virtualHosts."192.168.1.7" = {
    # serverAliases = [ "notes.example.com" ];   # if the tunnel forwards the public host

    root = "REPO_PATH/client/dist";

    locations."/" = {
      tryFiles = "$uri $uri/ /index.html";
    };

    # Never let the HTTP layer cache the service worker or the app shell.
    locations."= /sw.js".extraConfig = ''
      add_header Cache-Control "no-cache, no-store, must-revalidate";
      expires -1;
    '';

    locations."= /index.html".extraConfig = ''
      add_header Cache-Control "no-cache, no-store, must-revalidate";
      expires -1;
    '';

    # The manifest changes rarely but should not be pinned for a year.
    locations."= /manifest.json".extraConfig = ''
      add_header Cache-Control "no-cache";
      expires -1;
    '';

    # Vite content-hashes everything under /assets, so these are immutable.
    locations."/assets/".extraConfig = ''
      add_header Cache-Control "public, max-age=31536000, immutable";
    '';

    locations."/api" = {
      proxyPass = "http://localhost:3000";
    };

    locations."/socket" = {
      proxyPass = "http://localhost:3001";
      proxyWebsockets = true;
    };
  };
};

# Note on file access: nginx runs as its own user, so REPO_PATH/client/dist must
# be readable by it -- every parent directory needs +x. If the repo lives under
# /home/mab this usually means loosening the home directory's permissions, or
# putting the clone somewhere like /srv instead.