upstream guardia_backend {
    server guardia:8001;
    keepalive 32;
}

server {
    listen 80;
    server_name _;
    client_max_body_size 100M;

    # GUARDiA ITSM
    location / {
        proxy_pass         http://guardia_backend;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade    $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_set_header   Host       $host;
        proxy_set_header   X-Real-IP  $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }

    # 정적 파일 직접 서빙 (선택 최적화)
    # location /static/ {
    #     alias /app/static/;
    #     expires 1d;
    #     add_header Cache-Control "public";
    # }

    # Ollama/Tomcat 직접 노출 금지
    location /api/ollama/ { return 403; }
    location /manager/   { return 403; }
}

# HTTPS (인증서 설정 후 활성화)
# server {
#     listen 443 ssl http2;
#     server_name guardia.example.com;
#     ssl_certificate     /etc/nginx/ssl/cert.pem;
#     ssl_certificate_key /etc/nginx/ssl/key.pem;
#     ssl_protocols       TLSv1.2 TLSv1.3;
#     include /etc/nginx/conf.d/guardia.conf;  # location 블록 재사용
# }