nginx-base.conf.template

# Increase server names hash bucket size for long UUIDs
server_names_hash_bucket_size 128;

# Allow larger request bodies (audio uploads, file transfers, etc.)
# Applies to all server blocks: frontend, API, and workspace subdomains
client_max_body_size 50M;

# Enable DNS resolver for dynamic container resolution
resolver 127.0.0.11 valid=30s;

# Define connection upgrade mapping for WebSockets
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

upstream api_backend {
    server server:3000;
}

# Main server for the frontend and API
server {
        listen 80;
        server_name ${BASE_DOMAIN};

        # Frontend
        location / {
            root /usr/share/nginx/html/frontend;
            index index.html;
            try_files $uri $uri/ /index.html;
        }

        # API routes
        location /api/ {
            proxy_pass http://api_backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # GIT_SERVER_PLACEHOLDER
    }

    # Custom workspace subdomain aliases (auto-generated by aliasesService).
    # Each alias is rendered as an exact-match server_name, so it takes
    # priority over the regex-based UUID routing below.
    # Glob pattern makes it optional — first boot starts before the file exists.
    include /etc/nginx/dynamic/aliases.conf*;

    # Subdomain server for workspace applications on specific ports
    # Pattern: projectid-port.domain (e.g., projectid-5000.localhost or projectid-5000.ci.infra)
    # NOTE: This MUST come before the general workspace pattern to match first
    server {
        listen 80;
        server_name "~^(?<workspace_id>[a-f0-9\-]+)-(?<app_port>[0-9]{1,5})\.${BASE_DOMAIN}$";

        location / {
            set $upstream workspace-$workspace_id:$app_port;
            
            # Proxy to application running in workspace container
            proxy_pass http://$upstream;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $http_host;
            proxy_set_header X-Forwarded-Port $server_port;
            
            # WebSocket support for applications that need it
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 86400;
            proxy_send_timeout 86400;
        }
    }

    # Catch-all: any Host header that doesn't match a more-specific
    # server_name (frontend, workspace UUID, workspace port, custom alias)
    # ends up here and gets a clean 404 instead of silently falling
    # back to the auth-protected frontend.
    server {
        listen 80 default_server;
        server_name _;
        default_type text/plain;
        return 404 "Unknown subdomain. The alias may have been deleted or was never created.\n";
    }

    # Subdomain server for workspace code-server instances
    # Pattern: projectid.domain (e.g., projectid.localhost or projectid.ci.infra)
    server {
        listen 80;
        server_name ~^(?<workspace_id>[a-f0-9\-]+)\.${BASE_DOMAIN}$;

        location / {
            set $upstream workspace-$workspace_id:8082;
            
            # Proxy to code-server container
            proxy_pass http://$upstream;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $http_host;
            proxy_set_header X-Forwarded-Port $server_port;
            
            # WebSocket support for code-server
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_read_timeout 86400;
            proxy_send_timeout 86400;
        }
    }