upstream message_safety_api {
    server ${MESSAGE_SAFETY_UPSTREAM_HOST}:8080;
    keepalive 16;
}

upstream bitrix_sync {
    server ${BITRIX_SYNC_UPSTREAM_HOST}:8080;
    keepalive 16;
}

server {
    listen 8081;
    location = /nginx-health/live {
        access_log off;
        return 200 "ok\n";
    }
    location / {
        return 404;
    }
}

server {
    listen 8080;
    server_name ${PROCESSING_PUBLIC_HOST};

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/certbot;
        try_files $uri =404;
    }

    location = /bitrix/sync/webhook/contact {
        return 426;
    }
    location = /bitrix/sync/webhook/alert {
        return 426;
    }
    location / {
        return 308 https://$host$request_uri;
    }
}

server {
    listen 8444 ssl;
    http2 on;
    server_name ${PROCESSING_PUBLIC_HOST};

    ssl_certificate /run/public-tls/fullchain.pem;
    ssl_certificate_key /run/public-tls/privkey.pem;
    include /etc/nginx/allowlists/tls.conf;

    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy no-referrer always;
    add_header Cache-Control no-store always;

    location = /bitrix/sync/webhook/contact {
        # Core error logs include the raw request line and cannot redact query.
        error_log /dev/null crit;
        if ($request_method != POST) { return 405; }
        include /etc/nginx/allowlists/bitrix-webhook-allowlist.conf;
        limit_req zone=bitrix_webhooks burst=20 nodelay;
        limit_conn per_ip 10;
        client_max_body_size 128k;
        proxy_pass http://bitrix_sync;
        include /etc/nginx/allowlists/proxy-common.conf;
        proxy_read_timeout 60s;
    }

    location = /bitrix/sync/webhook/alert {
        # Rejections remain visible in query-free access logs and metrics.
        error_log /dev/null crit;
        if ($request_method != POST) { return 405; }
        include /etc/nginx/allowlists/bitrix-webhook-allowlist.conf;
        limit_req zone=bitrix_webhooks burst=20 nodelay;
        limit_conn per_ip 10;
        client_max_body_size 128k;
        proxy_pass http://bitrix_sync;
        include /etc/nginx/allowlists/proxy-common.conf;
        proxy_read_timeout 60s;
    }

    location / {
        return 404;
    }
}

server {
    listen 8443 ssl;
    server_name _;

    ssl_certificate /run/secrets/internal_tls_certificate;
    ssl_certificate_key /run/secrets/internal_tls_private_key;
    include /etc/nginx/allowlists/tls.conf;

    include /etc/nginx/allowlists/private-caller-allowlist.conf;
    client_max_body_size 256k;
    add_header Cache-Control no-store always;
    add_header X-Content-Type-Options nosniff always;

    location = /internal/safety/v2/messages/check {
        if ($request_method != POST) { return 405; }
        proxy_pass http://message_safety_api;
        include /etc/nginx/allowlists/proxy-common.conf;
        proxy_read_timeout 10s;
    }

    location ~ "^/internal/safety/v2/messages/tasks/[0-9a-fA-F-]{36}$" {
        if ($request_method != GET) { return 405; }
        proxy_pass http://message_safety_api;
        include /etc/nginx/allowlists/proxy-common.conf;
        proxy_read_timeout 5s;
    }

    location = /internal/safety/status {
        if ($request_method != GET) { return 405; }
        proxy_pass http://message_safety_api/health/ready;
        include /etc/nginx/allowlists/proxy-common.conf;
        proxy_read_timeout 60s;
    }

    location = /internal/sync/v1/status {
        if ($request_method != GET) { return 405; }
        proxy_pass http://bitrix_sync;
        include /etc/nginx/allowlists/proxy-common.conf;
        proxy_read_timeout 60s;
    }

    location / {
        return 404;
    }
}