# ═══════════════════════════════════════════════════════════
# 铸渊主权服务器 · Nginx 双域名配置
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-NGX-002
# 服务器: 43.134.16.246 (新加坡二区)
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
#
# 双域名架构:
#   主域名 (ZY_DOMAIN_MAIN)   → 正式对外网站 · /opt/zhuyuan/sites/production/
#   预览域名 (ZY_DOMAIN_PREVIEW) → 预览/测试站 · /opt/zhuyuan/sites/preview/
#
# 域名变量由 GitHub Secrets 注入:
#   ZY_DOMAIN_MAIN    — 主域名 (待冰朔配置)
#   ZY_DOMAIN_PREVIEW — 预览域名 (待冰朔配置)
# ═══════════════════════════════════════════════════════════

# ─── §1 主域名 · 正式对外网站 ───
# 部署时由 deploy workflow 自动将占位符替换为实际域名
# 替换源: GitHub Secrets → ZY_DOMAIN_MAIN
# ⚠️ 重要: guanghulab.online 必须配置为 ZY_DOMAIN_MAIN（不是 ZY_DOMAIN_PREVIEW）
#    否则 /api/* 请求会被路由到 §2 预览站的 3801 端口而非 3800 → 导致 502
# ⚠️ guanghulab.com 是ICP备案域名，部署在国内广州服务器(ZY-SVR-004)，不在这里配置
server {
    listen 80 default_server;
    server_name ZY_DOMAIN_MAIN_PLACEHOLDER 43.134.16.246;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Server-Identity "ZY-SVR-002" always;
    add_header X-Site-Mode "production" always;

    # ─── 静态文件根目录 · 主站 ───
    root /opt/zhuyuan/sites/production;
    index index.html;

    # ─── 前端静态文件 ───
    location / {
        try_files $uri $uri/ /index.html;
    }

    # ─── 铸渊核心 API (端口 3800) ───
    location /api/ {
        proxy_pass http://127.0.0.1:3800;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "production";
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 86400;
    }

    # ─── 铸渊 AGE OS MCP Server 反向代理 (端口 3100) ───
    # 外部访问需携带 Authorization: Bearer <ZHUYUAN_API_KEY>
    # 鉴权由 MCP Server 自身 apiKeyAuth 中间件处理
    # 知秋/团队人格体通过此入口访问人格体数据库、COS工具等
    location /api/mcp/ {
        proxy_pass http://127.0.0.1:3100/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Authorization $http_authorization;
        proxy_connect_timeout 10s;
        proxy_read_timeout 120s;
        proxy_send_timeout 30s;
        add_header X-Content-Type-Options nosniff always;

        # CORS · 允许团队人格体跨域调用
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if ($request_method = OPTIONS) { return 204; }
    }

    # ─── AI 聊天 API (端口 3800) · 主应用直接处理 ───
    # 聊天请求由主应用的 domestic-llm-gateway 智能路由处理
    # 支持 DeepSeek/千问/Moonshot/智谱 四路自动降级
    location /api/chat {
        # CORS · 允许前端跨域调用
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if ($request_method = OPTIONS) { return 204; }

        proxy_pass http://127.0.0.1:3800/api/chat;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;
        proxy_read_timeout 120s;
        proxy_send_timeout 60s;
    }

    # ─── Persona Studio API (端口 3002) ───
    location /api/ps/ {
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if ($request_method = OPTIONS) { return 204; }
        proxy_pass http://127.0.0.1:3002/api/ps/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_read_timeout 120s;
    }

    # ─── WebSocket ───
    location /ws {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400;
    }

    # ─── 铸渊专线订阅服务 (端口 3802) ───
    location /api/proxy-sub/ {
        proxy_pass http://127.0.0.1:3802/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 10s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
        add_header X-Content-Type-Options nosniff always;
        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
    }

    # ─── 健康探针 ───
    location = /health {
        proxy_pass http://127.0.0.1:3800/api/health;
        proxy_set_header Host $host;
    }

    # ─── 静态资源缓存 ───
    location /static/ {
        alias /opt/zhuyuan/sites/production/static/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # ─── 错误页面 ───
    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;

    # ─── 访问日志 ───
    access_log /opt/zhuyuan/data/logs/nginx-production.log;
    error_log /opt/zhuyuan/data/logs/nginx-production-error.log;
}


# ─── §2 预览域名 · 功能模块预览站 ───
# 部署时由 deploy workflow 自动将 ZY_DOMAIN_PREVIEW_PLACEHOLDER 替换为实际域名
# 替换源: GitHub Secrets → ZY_DOMAIN_PREVIEW
# 预览站与主站完全隔离，独立目录，独立日志
server {
    listen 80;
    server_name ZY_DOMAIN_PREVIEW_PLACEHOLDER;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Server-Identity "ZY-SVR-002" always;
    add_header X-Site-Mode "preview" always;

    # ─── 静态文件根目录 · 预览站 ───
    root /opt/zhuyuan/sites/preview;
    index index.html;

    # ─── 前端静态文件 ───
    location / {
        try_files $uri $uri/ /index.html;
    }

    # ─── 带宽授权短路径 · 邮件引导用户手动输入此地址 ───
    # 邮件不含可点击链接 (QQ邮箱反拦截)，引导用户在浏览器中输入 guanghulab.online/auth
    # 自动代理到V3订阅服务的公开授权页面
    location = /auth {
        proxy_pass http://ZY_BRAIN_HOST_PLACEHOLDER/api/proxy-v3/bandwidth-auth-open;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 10s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;
        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
    }

    # ─── 光湖语言世界V3 · 带宽授权桥接 (大脑服务器反向代理) ───
    # QQ邮箱拦截大脑服务器域名链接，此桥接通过guanghulab.online域名
    # 将V3授权/订阅请求透传到大脑服务器的V3订阅服务 (端口3805)
    # 协议: HTTP (内网通信，大脑服务器Nginx监听80端口default_server)
    # 部署时由 workflow 自动将 ZY_BRAIN_HOST_PLACEHOLDER 替换为实际IP
    # CORS: 允许GitHub Pages跨域调用带宽共享API
    location /api/proxy-v3/ {
        # CORS预检处理 (GitHub Pages跨域)
        if ($request_method = OPTIONS) {
            add_header Access-Control-Allow-Origin * always;
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Content-Type" always;
            add_header Access-Control-Max-Age 86400;
            return 204;
        }

        proxy_pass http://ZY_BRAIN_HOST_PLACEHOLDER/api/proxy-v3/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 10s;
        proxy_read_timeout 30s;
        proxy_send_timeout 30s;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;
        add_header Cache-Control "no-store, no-cache, must-revalidate" always;
        add_header Access-Control-Allow-Origin * always;
    }

    # ─── 铸渊 API 反向代理 (端口 3801 · 预览端口) ───
    location /api/ {
        proxy_pass http://127.0.0.1:3801;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Site-Mode "preview";
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 86400;
    }

    # ─── AI 聊天 API (端口 3801) · 预览站共享主应用聊天引擎 ───
    location /api/chat {
        # CORS · 允许前端跨域调用
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if ($request_method = OPTIONS) { return 204; }

        proxy_pass http://127.0.0.1:3801/api/chat;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 120s;
    }

    # ─── Persona Studio API (共享主站端口) ───
    location /api/ps/ {
        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if ($request_method = OPTIONS) { return 204; }
        proxy_pass http://127.0.0.1:3002/api/ps/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_read_timeout 120s;
    }

    # ─── 健康探针 ───
    location = /health {
        proxy_pass http://127.0.0.1:3801/api/health;
        proxy_set_header Host $host;
    }

    # ─── 预览站独立日志 ───
    access_log /opt/zhuyuan/data/logs/nginx-preview.log;
    error_log /opt/zhuyuan/data/logs/nginx-preview-error.log;
}


# ═══ §3 HTTPS/VPN 配置 (Xray Reality反探测架构) ═══════════════
#
# ⚠️ 重要: 443端口由Xray(VPN)占用，dest指向www.microsoft.com:443
#
# Reality反探测架构 (正确方案):
#   外部 443 → Xray (VLESS+Reality协议)
#     ├── 认证VLESS客户端 → 代理上网 (铸渊专线VPN)
#     └── 非VLESS流量(GFW探测) → dest回落到 www.microsoft.com:443
#         → 返回真实Microsoft证书 → GFW认为是正常HTTPS → 通过
#
#   外部 80 → Nginx (HTTP)
#     ├── 域名访问 → 直接服务网站 (本文件§1/§2)
#     └── 订阅API → /api/proxy-sub/ (反代到端口3802)
#
# ⚠️ 为什么dest不能指向127.0.0.1:8443?
#   GFW探测时会检查TLS证书是否匹配serverNames (www.microsoft.com)
#   如果dest返回guanghulab.online的证书 → 证书不匹配 → 被标记为可疑 → VPN被封
#   所以dest必须指向真实的microsoft.com以通过反探测
#
# CN中转架构 (广州→新加坡):
#   国内用户 → CN:2053 (Nginx stream TCP转发) → SG:443 (Xray)
#   国内订阅 → CN:80/api/proxy-sub/ → SG:80/api/proxy-sub/
#
# SSL方案:
#   网站通过HTTP(80端口)访问 · 不在443端口共存HTTPS
#   如需HTTPS · 使用Cloudflare CDN代理或独立配置
#
# Xray配置: server/proxy/config/xray-config-template.json
# CN中转: server/proxy/setup/setup-cn-relay.sh
# ═══════════════════════════════════════════════════════════════