# CyberLux — single onion ingress.
# Request handling: lib/onionRoutes.generated.ts + proxy.ts (Next.js 16+)
#
# Hub: 127.0.0.1:8080 — full app, all sections as paths
#
# Requires /etc/nginx/conf.d/cyberlux-ddos-zones.conf
# and /etc/nginx/cyberlux-server-common.inc
# (installed by scripts/install-tor-onion.sh).

# --- HUB (main storefront) ---
server {
    listen 127.0.0.1:8080 default_server;
    server_name _;

    include /etc/nginx/cyberlux-server-common.inc;
    proxy_hide_header X-Powered-By;

    client_max_body_size 25m;

    # ── Next.js static assets — long cache, NO rate limiting ──────────────────
    # These are content-hashed immutable files. Rate-limiting them causes the
    # Tor Browser to silently drop CSS/JS on first load (burst exhausted by the
    # HTML request before assets arrive).
    location /_next/static/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host 127.0.0.1;
        proxy_set_header X-Forwarded-Proto http;
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        access_log off;
    }

    # ── App routes — rate limited ─────────────────────────────────────────────
    location / {
        # Tor forwards every onion client from loopback, so zones are keyed
        # by $server_port to avoid collapsing all visitors into one bucket.
        limit_req zone=cyberlux_onion_req burst=120 nodelay;
        limit_conn cyberlux_onion_conn 60;
        limit_req_status 429;
        limit_conn_status 429;

        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto http;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 86400;
    }
}