nginx.conf

events {
    worker_connections 1024;
}

http {
    upstream dlstreamer {
        server dlstreamer-pipeline-server:8080;
    }

    upstream prometheus {
        server prometheus:9090;
    }

    upstream mediamtx {
        server mediamtx:8889;
    }

    upstream mediamtx-webrtc {
        server mediamtx:8189;
    }

    upstream minio {
        server minio:8000;
    }

    upstream otel_collector_grpc {
        server otel-collector:4317;
    }

    upstream otel_collector_http {
        server otel-collector:4318;
    }

    # HTTP server - redirect to HTTPS
    server {
        listen 80;
        return 301 https://$host$request_uri;
    }

    # HTTPS server
    server {
        listen 443 ssl;
        server_name localhost;

        client_max_body_size 500M;

        # SSL configuration
        ssl_certificate /etc/nginx/ssl/server.crt;
        ssl_certificate_key /etc/nginx/ssl/server.key;

        # SSL security settings
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # Security headers
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header X-Content-Type-Options nosniff;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-XSS-Protection "1; mode=block";

        # DL Streamer Pipeline Server
        location /api/ {
            proxy_pass http://dlstreamer/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Prometheus
        location /prometheus/ {
            proxy_pass http://prometheus;   # upstream already has port
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # MinIO
        location /minio/ {
            proxy_pass http://minio/minio/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Allow CORS for MinIO UI
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
            add_header Access-Control-Allow-Headers "Authorization, Content-Type";

            # Handle preflight requests
            if ($request_method = OPTIONS) {
                return 204;
            }
        }

        # OTEL Collector HTTP
        location /otel-http/ {
            proxy_pass http://otel_collector_http/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # OTEL Collector gRPC
        location /otel-grpc/ {
            grpc_pass grpc://otel_collector_grpc;
        }

        # MediaMTX streams with dynamic paths
        location /mediamtx/ {
            proxy_pass http://mediamtx/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # WebSocket support for WebRTC
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # MediaMTX WebRTC endpoint (port 8189)
        location /webrtc/ {
            proxy_pass http://mediamtx-webrtc/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # WebSocket support for WebRTC
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # MediaMTX stream paths and WHEP/WHIP endpoints
        location ~ ^/([^/]+)/(whep|whip)(/.*)?$ {
            proxy_pass http://mediamtx/$1/$2$3;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # WebSocket support for WebRTC
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            # CORS headers for WebRTC
            add_header Access-Control-Allow-Origin *;
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
            add_header Access-Control-Allow-Headers "Content-Type, Authorization";

            # Handle preflight requests
            if ($request_method = OPTIONS) {
                add_header Access-Control-Allow-Origin *;
                add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
                add_header Access-Control-Allow-Headers "Content-Type, Authorization";
                return 204;
            }
        }

        # Default landing page
        location / {
            return 200 '<!DOCTYPE html>
<html>
<head>
    <title>Manufacturing Vision AI Application</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 40px; }
        .service { margin: 20px 0; padding: 15px; border: 1px solid #ddd; border-radius: 5px; }
        a { color: #0066cc; text-decoration: none; }
        a:hover { text-decoration: underline; }
    </style>
</head>
<body>
    <h1>Manufacturing Vision AI Application</h1>
    <p>External facing services:</p>
    <div class="service">
        <h3><a href="/api/pipelines/status">DL Streamer API Pipeline Status</a></h3>
        <p>Deep Learning Streamer Pipeline Server API Pipeline Status</p>
    </div>
    <div class="service">
        <h3><a href="/prometheus/">Prometheus</a></h3>
        <p>Metrics monitoring and scraping</p>
    </div>
    <div class="service">
        <h3><a href="/minio/">MinIO</a></h3>
        <p>Object storage (S3-compatible)</p>
    </div>
</body>
</html>';
            add_header Content-Type text/html;
        }

        # Health check endpoint
        location /health {
            access_log off;
            return 200 "healthy\n";
            add_header Content-Type text/plain;
        }
    }
}