events {
    worker_connections 1024;
}

http {
    # Dynamically set Connection header (handles 'upgrade' and 'Upgrade')
    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    server {
        listen 80;

        # Standard HTTP Proxy to Apache
        location / {
            proxy_pass http://apache:80;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # WebSocket Proxy to Node
        location /ws/ {
            # Note: Add trailing slash if you want Nginx to strip '/ws/' before reaching Node
            proxy_pass http://node:8082/;

            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade; # Dynamic connection header
            
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Keep-alive settings for long-lived WebSocket connections
            proxy_read_timeout 36000s;
            proxy_send_timeout 36000s;
            proxy_connect_timeout 75s;
        }

        # Block access to hidden files (.htaccess, .git, .env, etc.)
        location ~ /\. {
            deny all;
            access_log off;
            log_not_found off;
        }
    }
}