worker_processes auto;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # Structured JSON access logs and correlation id
    map $http_x_request_id $req_id { default $http_x_request_id; "" $request_id; }
    log_format json escape=json '{"time":"$time_iso8601","req_id":"$req_id","remote":"$remote_addr","host":"$host","method":"$request_method","uri":"$request_uri","status":$status,"bytes":$bytes_sent,"referer":"$http_referer","ua":"$http_user_agent","up_addr":"$upstream_addr","up_st":"$upstream_status","up_rt":$upstream_response_time,"rt":$request_time}';

    # Log settings
    access_log /var/log/nginx/access.ndjson json;   # structured JSON for ELK
    access_log /var/log/nginx/access.log;           # standard combined for Elastic Agent nginx integration
    error_log  /var/log/nginx/error.log warn;

    # Gzip settings (optional)
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain application/xml text/css application/javascript application/json application/x-javascript text/javascript; 

    # Upstream pool for PHP-FPM (load-balanced)
    upstream php_fpm {
        least_conn;
        server php1:9000 max_fails=3 fail_timeout=10s;
        server php2:9000 max_fails=3 fail_timeout=10s;
        keepalive 32;
    }

    # HTTP server (no HTTPS for local development)
    server {
        listen 80;
        server_name _;

        # Logging headers
        add_header X-Request-Id $req_id always;

        # Root and index
        root /var/www/html;
        index index.php index.html index.htm;

        # Main application location
        location / {
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
            add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
            add_header Access-Control-Allow-Credentials true;
            if ($request_method = 'OPTIONS') {
                add_header Access-Control-Allow-Origin *;
                add_header Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE";
                add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number";
                return 204;
            }

            include fastcgi_params;
            fastcgi_pass php_fpm;
            fastcgi_index index.php;
            fastcgi_read_timeout 60s;
            fastcgi_param SCRIPT_FILENAME $document_root/index.php;
            fastcgi_param X_REQUEST_ID $req_id;
            fastcgi_keep_conn on;
        }

        # Deny access to hidden files
        location ~ /\. { deny all; }
        location ~ /\.ht { deny all; }
    }

    # Internal metrics endpoint for Metricbeat (not exposed to host)
    # Scraped at http://nginx:8080/stub_status by the metricbeat nginx module
    server {
        listen 8080;
        server_name _;
        access_log off;
        location /stub_status {
            stub_status;
            allow all; # safe within the docker network; not published to host
        }
    }
}