# =============================================
# 文件管理系统 Nginx 配置模板
# 支持两种文件访问模式:
# 1. 中转模式(proxy): Nginx → Server鉴权 → 返回文件
# 2. 预签名模式(presigned): 客户端 → Nginx → MinIO
# =============================================

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      off;
    charset       utf-8;

    # =============================================
    # Upstream: 后端服务 + MinIO
    # =============================================
    upstream fileserver {
        server 127.0.0.1:8080;  # Go文件管理服务
    }

    upstream minio {
        server 127.0.0.1:9000;  # MinIO服务
    }

    upstream minio_console {
        server 127.0.0.1:9001;  # MinIO控制台
    }

    server {
        listen       3090;
        server_name  localhost;
        client_max_body_size 500m;  # 最大上传500MB

        # =============================================
        # 1. API请求 → 后端服务
        # =============================================
        location ^~ /api/ {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass http://fileserver;
        }

        # =============================================
        # 2. 静态文件 - 中转模式(X-Sendfile)
        #    Server鉴权成功后返回X-Accel-Redirect头,
        #    Nginx直接从本地路径发送文件, 不经过Server
        # =============================================
        location ^~ /minio-files/ {
            internal;  # 仅允许内部重定向

            # MinIO数据目录(或挂载点)
            alias D:/Seeyon/A8/localfile/;

            # 优化大文件传输
            sendfile on;
            tcp_nopush on;

            # 缓存控制
            expires 30d;
            add_header Cache-Control "public, immutable";
        }

        # =============================================
        # 3. 预签名直连模式
        #    客户端拿到预签名URL后直接访问此路径
        #    Nginx转发到MinIO, 保留原始签名参数
        # =============================================
        location ^~ /minio/ {
            # 反向代理到MinIO
            # 关键: 必须保留Host和签名参数
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            # MinIO需要这些头来验证预签名
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;

            # 超时设置(大文件下载)
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;

            # 隐藏MinIO内部地址
            proxy_hide_header X-Amz-Id-2;
            proxy_hide_header X-Amz-Request-Id;

            proxy_pass http://minio;
        }

        # =============================================
        # 4. MinIO控制台(管理用, 可选)
        # =============================================
        location ^~ /minio-console/ {
            proxy_pass http://minio_console/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            # WebSocket支持(MinIO控制台需要)
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        # =============================================
        # 5. 前端静态资源
        # =============================================
        location / {
            root D:/Seeyon/A8/frontend/dist;
            index index.html;

            # SPA路由支持
            try_files $uri $uri/ /index.html;
        }
    }
}