# ============================================================
# AETHER CHAT — Nginx Yapılandırması
# BLOK 1.3 / aether.nginx.conf
#
# Kurulum:
#   sudo cp aether.nginx.conf /etc/nginx/sites-available/aether
#   sudo ln -s /etc/nginx/sites-available/aether /etc/nginx/sites-enabled/
#   sudo certbot --nginx -d yourdomain.com
#   sudo nginx -t && sudo systemctl reload nginx
# ============================================================

# Rate limit zone tanımı — bunu /etc/nginx/nginx.conf http{} bloğuna ekle:
# limit_req_zone $binary_remote_addr zone=aether_api:10m rate=30r/m;
# limit_req_zone $binary_remote_addr zone=aether_ws:10m  rate=5r/s;

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen      443 ssl http2;
    server_name yourdomain.com;

    # SSL (Certbot otomatik doldurur)
    ssl_certificate     /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    root  /var/www/aether/server;

    # ── Güvenlik başlıkları ──────────────────────────────────
    add_header Strict-Transport-Security  "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Frame-Options            "DENY"    always;
    add_header X-Content-Type-Options     "nosniff" always;
    add_header X-XSS-Protection           "1; mode=block" always;
    add_header Referrer-Policy            "no-referrer" always;
    add_header Content-Security-Policy    "default-src 'none'" always;

    # ── API endpoint'leri ────────────────────────────────────
    location /api/ {
        limit_req zone=aether_api burst=20 nodelay;

        try_files $uri =404;

        location ~ \.php$ {
            include        fastcgi_params;
            fastcgi_pass   unix:/var/run/php/php8.2-fpm.sock;
            fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param  HTTP_X_REAL_IP  $remote_addr;
            fastcgi_read_timeout 30;
        }
    }

    # verify_token.php sadece localhost — Nginx seviyesinde de koru
    location = /api/verify_token.php {
        allow 127.0.0.1;
        allow ::1;
        deny  all;

        fastcgi_pass  unix:/var/run/php/php8.2-fpm.sock;
        include       fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    # ── WebSocket proxy → Ratchet (port 8090) ───────────────
    location /ws {
        limit_req zone=aether_ws burst=10 nodelay;

        proxy_pass         http://127.0.0.1:8090;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade    $http_upgrade;
        proxy_set_header   Connection "Upgrade";
        proxy_set_header   Host       $host;
        proxy_set_header   X-Real-IP  $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout  86400s;   # 24 saat — uzun yaşayan WS bağlantıları için
        proxy_send_timeout  86400s;
        proxy_connect_timeout 10s;
    }

    # ── Diğer her şeyi engelle ───────────────────────────────
    location / {
        return 404;
    }

    # Gizli dosyalara erişimi engelle
    location ~ /\.(env|git|htaccess|htpasswd) {
        deny all;
        return 404;
    }

    # Loglama
    access_log /var/log/nginx/aether_access.log combined;
    error_log  /var/log/nginx/aether_error.log  warn;
}
