# helexa.ai — edge nginx for the public beta.
#
# Serves the built SPA (helexa.ai/dist) and reverse-proxies the two
# backends on the SAME ORIGIN, so the browser never makes a cross-origin
# request: no CORS, and the user's API key rides as a first-party bearer.
#
#   /            → static SPA (history fallback to index.html)
#   /v1, /health → helexa-router (OpenAI-compatible inference data-plane)
#   /api/        → helexa-upstream /web/v1/ (account control-plane)
#
# TLS is terminated here (certs omitted — wire up certbot / your CA). The
# upstream hosts below are examples; point them at your router/upstream.

upstream helexa_router   { server 127.0.0.1:8088; }
upstream helexa_upstream { server 127.0.0.1:8090; }

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name helexa.ai;

    # ssl_certificate     /etc/letsencrypt/live/helexa.ai/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/helexa.ai/privkey.pem;

    root /var/www/helexa.ai;
    index index.html;

    # Long-cache fingerprinted assets; never cache the HTML shell.
    location /assets/ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # Inference data-plane → router. Streaming (SSE): disable buffering so
    # tokens reach the browser as they arrive.
    location /v1/ {
        proxy_pass http://helexa_router;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Connection "";
        proxy_buffering off;
        proxy_read_timeout 300s;
    }
    location = /health {
        proxy_pass http://helexa_router;
    }

    # Account control-plane → upstream /web/v1/ (strip the /api prefix).
    location /api/ {
        proxy_pass http://helexa_upstream/web/v1/;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # SPA history fallback: anything else serves index.html.
    location / {
        try_files $uri $uri/ /index.html;
    }
}
