# Host nginx reverse proxy for the Dockerized app.
# Install on the Ubuntu host:
#   sudo cp docker/host-nginx/ktmspr.apps.mbip.my.conf \
#           /etc/nginx/sites-available/ktmspr.apps.mbip.my
#   sudo ln -s /etc/nginx/sites-available/ktmspr.apps.mbip.my \
#              /etc/nginx/sites-enabled/
#   sudo nginx -t && sudo systemctl reload nginx

server {
    listen 80;
    listen [::]:80;
    server_name ktmspr.apps.mbip.my;

    client_max_body_size 21M;

    access_log /var/log/nginx/ktmspr.access.log;
    error_log  /var/log/nginx/ktmspr.error.log;

    location / {
        proxy_pass http://127.0.0.1:8009;
        proxy_http_version 1.1;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;

        proxy_connect_timeout 30s;
        proxy_read_timeout    60s;
    }

    # GitHub webhook deploy -> container webhook (adnanh/webhook) di 127.0.0.1:9002.
    # Endpoint GitHub: https://ktmspr.apps.mbip.my/hooks/deploy
    location /hooks/ {
        proxy_pass http://127.0.0.1:9002;

        proxy_set_header Host            $host;
        proxy_set_header X-Real-IP       $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Deploy (build) ambil masa; bagi masa yg cukup utk response.
        proxy_read_timeout 600s;
    }
}

# NOTA: Selepas pasang SSL (certbot), blok di atas biasanya bertukar jadi
# `listen 443 ssl`. Pastikan KEDUA-DUA `location /` dan `location /hooks/`
# berada dalam blok 443 itu, dan `X-Forwarded-Proto $scheme` kekal ada.