# Nginx configuration for Matrix (Synapse + Element)
# Add to /etc/nginx/conf.d/ on NODE1

# Matrix Synapse API
location /_matrix/ {
    proxy_pass http://127.0.0.1:8008;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    
    # WebSocket support
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    
    # Increase timeouts for long-polling
    proxy_read_timeout 600s;
    proxy_send_timeout 600s;
    
    # Increase body size for media uploads
    client_max_body_size 50M;
}

# Synapse admin API (restrict access!)
location /_synapse/ {
    proxy_pass http://127.0.0.1:8008;
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    
    # Restrict to internal only
    # allow 127.0.0.1;
    # deny all;
}

# Element Web UI
location /element/ {
    alias /var/www/element/;
    index index.html;
    try_files $uri $uri/ /element/index.html;
    
    # Cache static assets
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

# .well-known for Matrix federation
location /.well-known/matrix/server {
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    return 200 '{"m.server": "matrix.daarion.space:443"}';
}

location /.well-known/matrix/client {
    default_type application/json;
    add_header Access-Control-Allow-Origin *;
    return 200 '{"m.homeserver": {"base_url": "https://matrix.daarion.space"}, "m.identity_server": {"base_url": "https://vector.im"}}';
}