# ─────────────────────────────────────────────────────────────────────────────
# Nginx — Angular frontend (static files)
# Domain: app.soarcorp.co.ke
#
# Build first:
#   cd /var/www/demand-lead-frontend
#   npm ci && npm run build
#   # Output goes to dist/Frontend/browser/
# ─────────────────────────────────────────────────────────────────────────────

server {
    listen 80;
    server_name app.soarcorp.co.ke soarcorp.co.ke;
    return 301 https://app.soarcorp.co.ke$request_uri;
}

server {
    listen 443 ssl http2;
    server_name app.soarcorp.co.ke;

    # SSL — filled in by Certbot automatically
    # ssl_certificate     /etc/letsencrypt/live/app.soarcorp.co.ke/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/app.soarcorp.co.ke/privkey.pem;
    # include /etc/letsencrypt/options-ssl-nginx.conf;
    # ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/demand-lead-frontend/dist/Frontend/browser;
    index index.html;

    # Security headers
    add_header X-Frame-Options           "SAMEORIGIN"            always;
    add_header X-Content-Type-Options    "nosniff"               always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy   "default-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;" always;

    # Gzip static assets
    gzip on;
    gzip_static on;
    gzip_types text/html text/css application/javascript application/json image/svg+xml;

    # Angular — all routes fall back to index.html for client-side routing
    location / {
        try_files $uri $uri/ /index.html;
    }

    # Cache hashed static assets for 1 year
    location ~* \.(js|css|woff2?|ttf|otf|eot|svg|ico|png|jpg|webp)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    # Never cache index.html so Angular picks up new deployments immediately
    location = /index.html {
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    access_log /var/log/nginx/app.soarcorp.access.log;
    error_log  /var/log/nginx/app.soarcorp.error.log;
}

# Redirect bare domain to app subdomain
server {
    listen 443 ssl http2;
    server_name soarcorp.co.ke;

    # ssl_certificate     /etc/letsencrypt/live/soarcorp.co.ke/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/soarcorp.co.ke/privkey.pem;
    # include /etc/letsencrypt/options-ssl-nginx.conf;

    return 301 https://app.soarcorp.co.ke$request_uri;
}