nginx.conf

# Map to handle CORS origins
map $http_origin $cors_origin {
  default "";
  "~^https?://(www\.)?atomize\.ink$" $http_origin;
  "~^https?://(www\.)?leanly\.ink$" $http_origin;
  "~^http://localhost(:[0-9]+)?$" $http_origin;
}

# Global SSL session cache
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

# Enable gzip compression
gzip on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

server {
  listen 80;
  server_name eduardovedes.com www.eduardovedes.com atomize.ink www.atomize.ink minio.atomize.ink leanly.ink www.leanly.ink;

  access_log /var/log/nginx/http_redirect.access.log;
  error_log /var/log/nginx/http_redirect.error.log;

  location / {
    return 301 https://$host$request_uri;
  }
}

server {
  listen 443 ssl;
  server_name atomize.ink www.atomize.ink;
  client_max_body_size 500M;

  access_log /var/log/nginx/atomize.access.log;
  error_log /var/log/nginx/atomize.error.log;

  ssl_certificate /etc/nginx/ssl/atomize/fullchain.pem;
  ssl_certificate_key /etc/nginx/ssl/atomize/privkey.pem;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers HIGH:!aNULL:!MD5;
  add_header Strict-Transport-Security "max-age=31536000" always;

  location / {
    proxy_pass http://atomize-frontend:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /api/v1 {
    proxy_pass http://atomize-backend:3001;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /socket.io/ {
    proxy_pass http://atomize-backend:3001;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # WebSocket timeout settings
    proxy_read_timeout 86400;
    proxy_send_timeout 86400;
  }
}

server {
  listen 443 ssl;
  server_name minio.atomize.ink;
  client_max_body_size 500M;

  access_log /var/log/nginx/minio.access.log;
  error_log /var/log/nginx/minio.error.log;

  ssl_certificate /etc/nginx/ssl/minio/fullchain.pem;
  ssl_certificate_key /etc/nginx/ssl/minio/privkey.pem;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers HIGH:!aNULL:!MD5;
  add_header Strict-Transport-Security "max-age=31536000" always;

  location / {
    proxy_pass http://batmanvps-minio:9000;

    # Preserve original headers for S3 signature validation
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Important for presigned URLs - don't modify the request
    proxy_pass_request_headers on;
    proxy_set_header Connection "";
    proxy_http_version 1.1;

    # Disable request/response buffering for large files
    proxy_request_buffering off;
    proxy_buffering off;

    # Increase timeouts for large uploads
    proxy_connect_timeout 300;
    proxy_send_timeout 300;
    proxy_read_timeout 300;
    send_timeout 300;

    # Hide MinIO's CORS headers to prevent duplicates
    proxy_hide_header Access-Control-Allow-Origin;
    proxy_hide_header Access-Control-Allow-Methods;
    proxy_hide_header Access-Control-Allow-Headers;
    proxy_hide_header Access-Control-Expose-Headers;
    proxy_hide_header Access-Control-Allow-Credentials;

    # Handle preflight OPTIONS requests first (before adding headers)
    if ($request_method = 'OPTIONS') {
      add_header 'Access-Control-Allow-Origin' $cors_origin;
      add_header 'Access-Control-Allow-Methods' 'GET, PUT, POST, DELETE, HEAD, OPTIONS';
      add_header 'Access-Control-Allow-Headers' '*';
      add_header 'Access-Control-Max-Age' '86400';
      add_header 'Content-Type' 'text/plain; charset=utf-8';
      add_header 'Content-Length' '0';
      return 204;
    }

    # Add CORS headers for actual requests
    add_header 'Access-Control-Allow-Origin' $cors_origin always;
    add_header 'Access-Control-Allow-Credentials' 'true' always;
    add_header 'Access-Control-Expose-Headers' 'ETag, Content-Length, x-amz-request-id, x-amz-id-2' always;
  }
}

server {
  listen 443 ssl;
  server_name eduardovedes.com www.eduardovedes.com;
  client_max_body_size 500M;

  access_log /var/log/nginx/eduardovedes.access.log;
  error_log /var/log/nginx/eduardovedes.error.log;

  ssl_certificate /etc/nginx/ssl/eduardovedes/fullchain.pem;
  ssl_certificate_key /etc/nginx/ssl/eduardovedes/privkey.pem;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers HIGH:!aNULL:!MD5;
  add_header Strict-Transport-Security "max-age=31536000" always;

  location / {
    proxy_pass http://frontend-eduardovedes:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

server {
  listen 443 ssl;
  server_name leanly.ink www.leanly.ink;
  client_max_body_size 500M;

  access_log /var/log/nginx/leanly.access.log;
  error_log /var/log/nginx/leanly.error.log;

  ssl_certificate /etc/nginx/ssl/leanly/fullchain.pem;
  ssl_certificate_key /etc/nginx/ssl/leanly/privkey.pem;

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;
  ssl_ciphers HIGH:!aNULL:!MD5;
  add_header Strict-Transport-Security "max-age=31536000" always;

  location / {
    proxy_pass http://leanly-frontend:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /api/v1 {
    proxy_pass http://leanly-backend:3001;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  location /socket.io/ {
    proxy_pass http://leanly-backend:3001;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # WebSocket timeout settings
    proxy_read_timeout 86400;
    proxy_send_timeout 86400;
  }
}