# Include at nginx http scope (for example /etc/nginx/conf.d/cms.conf).
# Mode: browsers connect directly to this nginx, on the CMS Docker host.
# Replace EVERY hotel.example and both certificate paths before nginx -t.
# Requires ngx_http_realip_module: $realip_remote_addr keeps the socket peer
# even when an unrelated global real_ip configuration rewrites $remote_addr.
server {
    listen 80;
    listen [::]:80;
    server_name hotel.example;
    if ($host != hotel.example) { return 444; }
    return 308 https://hotel.example$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name hotel.example;
    if ($host != hotel.example) { return 444; }
    ssl_certificate /etc/letsencrypt/live/hotel.example/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/hotel.example/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    # Studio's authenticated attachment endpoints accept at most 52 MiB.
    # This ingress allowance includes multipart overhead; application caps remain.
    client_max_body_size 64m;

    location / {
        proxy_pass http://127.0.0.1:3002;
        proxy_http_version 1.1;
        proxy_set_header Host hotel.example;
        proxy_set_header X-Forwarded-Host hotel.example;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Port 443;
        proxy_set_header X-Forwarded-For $realip_remote_addr;
        proxy_set_header X-Real-IP $realip_remote_addr;
        proxy_set_header CF-Connecting-IP "";
        proxy_set_header X-Real-Client-IP "";
        proxy_set_header Forwarded "";
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_read_timeout 300s;
        proxy_cache off;
    }
}