worker_processes auto;
pid /tmp/nginx.pid;

events { worker_connections 1024; }

http {
  access_log /dev/stdout;
  error_log  /dev/stderr info;

  # Use writable temp paths in Spaces
  client_body_temp_path /tmp/nginx/client_temp;
  proxy_temp_path       /tmp/nginx/proxy_temp;
  fastcgi_temp_path     /tmp/nginx/fastcgi_temp;
  uwsgi_temp_path       /tmp/nginx/uwsgi_temp;
  scgi_temp_path        /tmp/nginx/scgi_temp;

  map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
  }

  server {
    listen 7860;

    location = /health {
      default_type text/plain;
      return 200 "ok\n";
    }

    location / {
      proxy_pass https://${UPSTREAM_HOST};
      proxy_http_version 1.1;

      # auth to the private Space (server-side only)
      proxy_set_header Authorization "Bearer ${HF_TOKEN}";
      proxy_set_header Host ${UPSTREAM_HOST};
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # WebSockets for Shiny
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;

      proxy_connect_timeout 30s;
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
      proxy_buffering off;

      # Make upstream cookies/redirects work on the public domain
      proxy_cookie_domain ${UPSTREAM_HOST} $host;
      proxy_redirect https://${UPSTREAM_HOST}/ /;

      proxy_ssl_server_name on;
    }
  }
}