nginx.conf

worker_processes auto;
error_log /dev/stderr warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent"';

    access_log /dev/stdout main;
    sendfile on;
    keepalive_timeout 65;

    # Gzip compression — significant bandwidth savings on RPi4
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_min_length 256;
    gzip_comp_level 4;
    gzip_types
        text/plain
        text/css
        text/javascript
        application/json
        application/javascript
        application/x-javascript
        image/svg+xml;

    # Docker's embedded DNS — only used for the `frontend` upstream below.
    # See the location / block for why we resolve frontend dynamically
    # rather than via a static `upstream{}` block.
    resolver 127.0.0.11 valid=30s ipv6=off;

    # Backend goes through a normal `upstream{}`. The hostname `backend`
    # is provided via docker-compose `extra_hosts: backend:host-gateway`,
    # which writes a /etc/hosts entry. nginx's `upstream{}` resolves
    # at config-parse time using libc (which honours /etc/hosts), so
    # this works reliably. Don't switch to a variable here — nginx's
    # `resolver`-based runtime resolution bypasses /etc/hosts entirely
    # and would fail to find `backend`.
    upstream backend {
        server backend:8000;
        keepalive 32;
    }

    server {
        listen 80;
        server_name _;

        # Frontend SPA — resolved dynamically.
        #
        # The frontend container (alias `frontend` on the user-defined
        # bridge network) registers with Docker's embedded DNS. With
        # newer Docker versions, `server frontend:80` inside an
        # `upstream{}` block resolves at nginx config-parse time; on
        # a cold `docker compose up` nginx can race the frontend
        # container's DNS registration and abort with
        # `host not found in upstream`. Wrapping the host in a variable
        # forces nginx to defer resolution to first-request time, which
        # always lands after the target container is reachable.
        location / {
            set $frontend "frontend";
            proxy_pass http://$frontend:80;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_cache_bypass $http_upgrade;
        }

        # API proxy — uses static `upstream backend` so /etc/hosts works.
        location /api/ {
            proxy_pass http://backend/api/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_http_version 1.1;
            proxy_read_timeout 120s;
        }

        # WebSocket for logs streaming
        location /api/logs/stream {
            proxy_pass http://backend/api/logs/stream;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
        }

        # WebSocket for server-tasks (deploy job) live log streaming
        # since v1.3.0-beta.1 — paths look like
        # /api/server-tasks/<job_id>/stream?token=<jwt>
        # Job IDs are 32-char uuid hex; the regex matches that exactly so
        # this location stays narrow and doesn't shadow the REST routes
        # under /api/server-tasks/{id}/cancel etc.
        location ~ ^/api/server-tasks/[a-f0-9]+/stream$ {
            proxy_pass http://backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_read_timeout 3600s;
            proxy_send_timeout 3600s;
        }

        # Health check
        location /health {
            proxy_pass http://backend/health;
            access_log off;
        }
    }
}