# nginx gateway — only two public listeners:
#   :443  Engine API + SSO (/ovirt-engine/…)
#   :5000 Web UI console
# Upstream FastAPI listens on simulator:8080.

upstream ovirt_simulator {
    server simulator:8080;
    keepalive 32;
}

# --- Engine HTTPS (API + SSO) ---
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name _;

    ssl_certificate     /etc/nginx/tls/server.crt;
    ssl_certificate_key /etc/nginx/tls/server.key;
    ssl_protocols       TLSv1.2 TLSv1.3;

    client_max_body_size 64m;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Port 443;
        proxy_pass http://ovirt_simulator;
    }
}

# --- Simulator Web UI console ---
server {
    listen 5000;
    listen [::]:5000;
    server_name _;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port 5000;
        proxy_pass http://ovirt_simulator;
    }
}