oneuptime/Nginx/default.conf.template

## Hash tuning for many/long server names. Can be overridden via env vars.
## Defaults are provided by envsubst-on-templates.sh if not set.
server_names_hash_bucket_size ${SERVER_NAMES_HASH_BUCKET_SIZE};
server_names_hash_max_size ${SERVER_NAMES_HASH_MAX_SIZE};

upstream app {
    server ${SERVER_APP_HOSTNAME}:${APP_PORT} weight=10 max_fails=3 fail_timeout=30s; 
}

upstream telemetry {
    server ${SERVER_TELEMETRY_HOSTNAME}:${TELEMETRY_PORT} weight=10 max_fails=3 fail_timeout=30s;
}

upstream worker {
    server ${SERVER_WORKER_HOSTNAME}:${WORKER_PORT} weight=10 max_fails=3 fail_timeout=30s;
}

upstream workflow {
    server ${SERVER_WORKFLOW_HOSTNAME}:${WORKFLOW_PORT} weight=10 max_fails=3 fail_timeout=30s;
}

upstream docs {
    server ${SERVER_DOCS_HOSTNAME}:${DOCS_PORT} weight=10 max_fails=3 fail_timeout=30s;
}

upstream home {
    server ${SERVER_HOME_HOSTNAME}:${HOME_PORT} weight=10 max_fails=3 fail_timeout=30s;
}

upstream opentelemetry-collector-http {
    server ${SERVER_OTEL_COLLECTOR_HOSTNAME}:4318;
}

upstream opentelemetry-collector-grpc {
    server ${SERVER_OTEL_COLLECTOR_HOSTNAME}:4317;
}

# Status Pages

server {

    server_tokens off;
    

    gzip on;
    gzip_types      text/plain application/xml application/javascript text/javascript text/css application/json;
    gzip_proxied    no-cache no-store private expired auth;
    gzip_min_length 1000;
   
    listen ${NGINX_LISTEN_ADDRESS}7849 default_server ${NGINX_LISTEN_OPTIONS};

    server_name  _; # All domains. 

    proxy_busy_buffers_size   512k;
    proxy_buffers   4 512k;
    proxy_buffer_size   256k;

    fastcgi_buffers  16 16k;
    fastcgi_buffer_size  32k;

    set $billing_enabled ${BILLING_ENABLED};


    location / {

        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        if ($billing_enabled = true) {
            return 301 https://$host$request_uri;
        }

        if ($billing_enabled != true) {
            proxy_pass http://app;
        }
        
    }

    location /status-page {

        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        if ($billing_enabled = true) {
            return 301 https://$host$request_uri;
        }

        if ($billing_enabled != true) {
            proxy_pass http://app;
        }
    }

    location /status-page-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/status-page/;
    }

    location /status-page-sso-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/identity/status-page-sso/;
    }

    location /status-page-identity-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/identity/status-page/;
    }

    # Acme Verification.
    location /.well-known {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass  http://app/api/status-page/.well-known;
    }

}

# 

server {

    server_tokens off;
    

    gzip on;
    gzip_types      text/plain application/xml application/javascript text/javascript text/css application/json;
    gzip_proxied    no-cache no-store private expired auth;
    gzip_min_length 1000;

    listen ${NGINX_LISTEN_ADDRESS}7850 ssl default_server ${NGINX_LISTEN_OPTIONS}; # Port HTTPS


    ssl_certificate /etc/nginx/certs/StatusPageCerts/$ssl_server_name.crt; 
    ssl_certificate_key /etc/nginx/certs/StatusPageCerts/$ssl_server_name.key;

    server_name  _; # All domains. 

    proxy_busy_buffers_size   512k;
    proxy_buffers   4 512k;
    proxy_buffer_size   256k;

    fastcgi_buffers  16 16k;
    fastcgi_buffer_size  32k;

    location / {

        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app;

        
    }

    location /status-page-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/status-page/;
    }

    location /status-page-sso-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/identity/status-page-sso/;
    }

    location /status-page-identity-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/identity/status-page/;
    }

    location /status-page {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app;
    }
}

server {

    server_tokens off;
    

    gzip on;
    gzip_types      text/plain application/xml application/javascript text/javascript text/css application/json;
    gzip_proxied    no-cache no-store private expired auth;
    gzip_min_length 1000;
    
    listen ${NGINX_LISTEN_ADDRESS}7849 ${NGINX_LISTEN_OPTIONS};
${PROVISION_SSL_LISTEN_DIRECTIVE}
${PROVISION_SSL_CERTIFICATE_DIRECTIVE}
${PROVISION_SSL_CERTIFICATE_KEY_DIRECTIVE}
    http2  on;

    server_name localhost ingress ${HOST}; #All domains

    proxy_busy_buffers_size   512k;
    proxy_buffers   4 512k;
    proxy_buffer_size   256k;

    fastcgi_buffers  16 16k;
    fastcgi_buffer_size  32k;

    set $billing_enabled ${BILLING_ENABLED};

    location / {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $server_name;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # If billing_enabled is true then proxy to home otherwise to dashboard because we dont need marketing paages for on-prem install.
        if ($billing_enabled = true) {
            proxy_pass http://home;
        }

        if ($billing_enabled != true) {
            proxy_pass http://app;
        }
    }

    # ACME Challenge for primary domain.
    location /.well-known/acme-challenge {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass  http://app/api/acme-challenge/.well-known;
    }

    location /.well-known/assetlinks.json {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass  http://home/.well-known/assetlinks.json;
    }

    # PWA manifest and service worker with proper headers for home
    location ~* ^/(manifest\.json|service-worker\.js)$ {
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Cache manifest for 1 hour, service worker for no cache
        if ($uri ~* "service-worker\.js$") {
            add_header Cache-Control "no-cache, no-store, must-revalidate" always;
            add_header Pragma "no-cache" always;
            add_header Expires "0" always;
        }
        
        if ($uri ~* "manifest\.json$") {
            add_header Cache-Control "public, max-age=3600" always;
        }
        
        # Serve from home if billing enabled, dashboard otherwise
        if ($billing_enabled = true) {
            proxy_pass http://home;
        }

        if ($billing_enabled != true) {
            proxy_pass http://app;
        }
    }


    location /status-page-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/status-page/;
    }

    location /status-page-sso-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/identity/status-page-sso/;
    }

    location /status-page-identity-api/ {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app/api/identity/status-page/;
    }
    

    location /accounts {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app;
    }


    location /telemetry {

        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://telemetry;
    }

     location /incoming-request-ingest {

        # This is for nginx not to crash when service is not available.
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://telemetry;
    }

    location /otlp/ {

        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";


        proxy_pass http://opentelemetry-collector-http/;
    }


    location ~ /opentelemetry.proto.collector* {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        grpc_pass grpc://opentelemetry-collector-grpc;
    }

    location /notification {
        # This is for nginx not to crash when service is not available.
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # Use upstream X-Forwarded-Proto if available (for webhook signature validation behind proxies like ngrok)
        # Falls back to $scheme if not set
        set $forwarded_proto $http_x_forwarded_proto;
        if ($forwarded_proto = '') {
            set $forwarded_proto $scheme;
        }
        proxy_set_header X-Forwarded-Proto $forwarded_proto;
        proxy_set_header X-Forwarded-Host $host;

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app/api/notification;
    }

    location /fluentd/logs {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass  http://telemetry/fluentd/v1/logs;
    }

    location /syslog/v1/logs {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass  http://telemetry/syslog/v1/logs;
    }

    location /probe-ingest {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://telemetry;

        client_max_body_size 50M;
    }

    # For backward compatibility with probes that are already deployed
    location /ingestor {
        # This is for nginx not to crash when service is not available.
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://telemetry;

        client_max_body_size 50M;
    }

    location /server-monitor {
        # This is for nginx not to crash when service is not available.
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://telemetry/server-monitor;

        client_max_body_size 50M;
    }

    location /dashboard {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        
        # PWA Headers for proper caching
        add_header Cache-Control "public, max-age=31536000" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        add_header X-XSS-Protection "1; mode=block" always;
        
        proxy_pass http://app;
    }

    # PWA manifest and service worker with proper headers
    location ~* ^/dashboard/(manifest\.json|sw\.js|browserconfig\.xml)$ {
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # Cache manifest for 1 hour, service worker for no cache
        if ($uri ~* "sw\.js$") {
            add_header Cache-Control "no-cache, no-store, must-revalidate" always;
            add_header Pragma "no-cache" always;
            add_header Expires "0" always;
        }
        
        if ($uri ~* "manifest\.json$") {
            add_header Cache-Control "public, max-age=3600" always;
        }
        
        if ($uri ~* "browserconfig\.xml$") {
            add_header Cache-Control "public, max-age=86400" always;
        }
        
        proxy_pass http://app;
    }


    location /admin {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app;
    }

    location /worker {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://worker;
    }

    location /status-page {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://app;
    }

    location /identity {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app/api/identity;
    }

    location /reference {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://docs/reference;
    }

    location /docs {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://docs/docs;
    }

    location /file {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app/api/file;

        client_max_body_size 50M;
    }

    location /api {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app/api;

        client_max_body_size 50M;
    }

    location /realtime {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app;

        client_max_body_size 50M;
    }

    location /analytics-api {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app;

        client_max_body_size 50M;
    }


    location /heartbeat {
        # This is for nginx not to crash when service is not available.
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://telemetry/incoming-request;

        client_max_body_size 50M;
    }

    location /incoming-email {
        # Incoming Email Monitor webhook endpoint
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://telemetry/incoming-email;

        client_max_body_size 50M;
    }


    location /workflow {
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://workflow;

        client_max_body_size 50M;
    }

    location /l/ { # Short URL for Link Shortener
        # This is for nginx not to crash when service is not available. 
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme; 

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app/api/short-link/redirect-to-shortlink/;

        client_max_body_size 50M;
    }

    location /workers {
        # This is for nginx not to crash when service is not available.
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # enable WebSockets (for ws://sockjs not connected error in the accounts source: https://stackoverflow.com/questions/41381444/websocket-connection-failed-error-during-websocket-handshake-unexpected-respon)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://app/api/workers;
    }

    location /mcp {
        # This is for nginx not to crash when service is not available.
        resolver 127.0.0.1 valid=30s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # enable WebSockets and SSE (for MCP Server-Sent Events)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # SSE specific settings for long-lived connections
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        chunked_transfer_encoding on;

        proxy_pass http://app;
    }
}