# ═══════════════════════════════════════════════════════════
# 零点原核 · 冰朔个人频道 Nginx 配置
# ═══════════════════════════════════════════════════════════
#
# 编号: ZY-SVR-NGX-YAOMING
# 域名: guanghuyaoming.com (ZY_FACE_DOMAIN)
# 服务器: 43.134.16.246 (ZY-SVR-002 · 新加坡)
# 守护: 铸渊 · ICE-GL-ZY001
# 版权: 国作登字-2026-A-00037559
#
# 架构:
#   guanghuyaoming.com → 冰朔零点原核频道
#   前端: /opt/zhuyuan/sites/yaoming/ (静态HTML)
#   后端: 复用铸渊主权服务器 (端口3800)
#   AI: 国内模型网关 + 第三方代理模型
#
# 域名变量由 GitHub Secrets 注入:
#   ZY_FACE_DOMAIN — 零点原核域名
# ═══════════════════════════════════════════════════════════

server {
    listen 80;
    server_name ZY_FACE_DOMAIN_PLACEHOLDER;

    # ─── 安全头 ───
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Server-Identity "ZY-SVR-002" always;
    add_header X-Site-Mode "yaoming-channel" always;

    # ─── 静态文件根目录 · 零点原核频道 ───
    root /opt/zhuyuan/sites/yaoming;
    index index.html;

    # ─── 前端静态文件 ───
    location / {
        try_files $uri $uri/ /index.html;
    }

    # ─── 智库节点页面 · 301 永久跳转到 guanghu.online ───
    location = /zhiku.html {
        return 301 https://guanghu.online;
    }

    # ─── 智库节点 API · novel-db (端口 4000) ───
    # /api/zhiku/* 和 /api/novel/* 路由到 novel-db 进程 (端口 4000)
    # Nginx 前缀匹配优先级: 更长前缀 > 短前缀
    # 因此 /api/zhiku/ 会优先于 /api/ 匹配，确保智库请求走 4000 而非 3800
    location /api/zhiku/ {
        proxy_pass http://127.0.0.1:4000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "zhiku-node";
        proxy_hide_header X-Powered-By;
        proxy_read_timeout 120s;
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
    }

    location /api/novel/ {
        proxy_pass http://127.0.0.1:4000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "novel-node";
        proxy_hide_header X-Powered-By;
        proxy_read_timeout 120s;
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
    }

    # ─── GLADA Agent API (端口 3900) ───
    location /api/glada/ {
        proxy_pass http://127.0.0.1:3900;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "glada-agent";
        proxy_hide_header X-Powered-By;
        proxy_read_timeout 120s;
        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
    }

    # ─── 运维守卫 ops-agent API (端口 3950) ───
    location /api/ops/ {
        proxy_pass http://127.0.0.1:3950;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "ops-agent";
        proxy_hide_header X-Powered-By;
        proxy_read_timeout 30s;
        proxy_connect_timeout 5s;
        proxy_send_timeout 10s;
    }

    # ─── 运维守卫健康检查 (直通端口 3950) ───
    location = /api/ops-health {
        proxy_pass http://127.0.0.1:3950/health;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_connect_timeout 5s;
        proxy_read_timeout 10s;
    }

    # ─── 运维守卫 SSE 实时推送 ───
    location = /api/ops/events {
        proxy_pass http://127.0.0.1:3950/ops/events;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;
        proxy_read_timeout 86400;
    }

    # ─── 铸渊核心 API (端口 3800) ───
    location /api/ {
        proxy_pass http://127.0.0.1:3800;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "yaoming-channel";
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 120s;
    }

    # ─── AI 聊天 API (含国内模型网关) ───
    # /api/chat         → 第三方模型线路
    # /api/chat/domestic → 国内四模型智能路由
    location /api/chat {
        proxy_pass http://127.0.0.1:3800;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;
        proxy_read_timeout 120s;
        proxy_send_timeout 60s;
    }

    # ─── MCP 对话接口 (铸渊主权服务器3800，非MCP Server3100) ───
    # /api/mcp/chat 需要优先匹配到3800，因为对话逻辑在铸渊服务器上
    location = /api/mcp/chat {
        proxy_pass http://127.0.0.1:3800;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_read_timeout 120s;
    }

    # ─── MCP Server 反向代理 (端口 3100) ───
    location /api/mcp/ {
        proxy_pass http://127.0.0.1:3100/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Authorization $http_authorization;
        proxy_connect_timeout 10s;
        proxy_read_timeout 120s;

        add_header Access-Control-Allow-Origin * always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
        if ($request_method = OPTIONS) { return 204; }
    }

    # ─── GitHub OAuth 回调 ───
    location /api/auth/ {
        proxy_pass http://127.0.0.1:3800;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # ─── WebSocket ───
    location /ws {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 86400;
    }

    # ─── [兼容保留] 智库节点 novel-api 反向代理 (端口 4000) ───
    # 新前端已改用 /api/zhiku/ 和 /api/novel/ 直接路由（见上方 location 块）
    # 此 /novel-api/ 仅保留用于向后兼容，避免旧缓存页面请求失败
    location /novel-api/ {
        proxy_pass http://127.0.0.1:4000/;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Site-Mode "zhiku-node";
        proxy_hide_header X-Powered-By;
        proxy_read_timeout 120s;
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
    }

    # ─── 健康探针 ───
    location = /health {
        proxy_pass http://127.0.0.1:3800/api/health;
        proxy_set_header Host $host;
    }

    # ─── 静态资源缓存 ───
    location /static/ {
        alias /opt/zhuyuan/sites/yaoming/static/;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }

    # ─── 错误页面 ───
    error_page 404 /index.html;
    error_page 500 502 503 504 /index.html;

    # ─── 访问日志 ───
    access_log /opt/zhuyuan/data/logs/nginx-yaoming.log;
    error_log /opt/zhuyuan/data/logs/nginx-yaoming-error.log;
}