# Configuración HTTPS para producción con Let's Encrypt
# Este archivo se monta en: /etc/nginx/http.d/ssl.conf

# Redirigir HTTP a HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name bot.u-s.app;
    
    # Permitir verificación de Let's Encrypt
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }
    
    # Redirigir todo lo demás a HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS Server
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name bot.u-s.app;

    # Certificados SSL de Let's Encrypt
    ssl_certificate /etc/letsencrypt/live/bot.u-s.app/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bot.u-s.app/privkey.pem;
    
    # Configuración SSL moderna
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    
    # HSTS (descomentar en producción después de verificar que SSL funciona)
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    
    # Headers de seguridad
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    
    # Root y configuración PHP
    root /var/www/html;
    index index.php index.html;
    
    # Tamaño máximo de upload
    client_max_body_size 100M;
    
    # Logs
    access_log /var/log/nginx/ssl_access.log;
    error_log /var/log/nginx/ssl_error.log;
    
    # PHP-FPM
    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        fastcgi_read_timeout 300;
    }
    
    # API endpoints
    location /api/ {
        try_files $uri $uri/ /api/index.php?$query_string;
    }
    
    # Webhook
    location /webhook {
        try_files $uri $uri/ /webhook.php?$query_string;
    }
    
    # Archivos estáticos - cache agresivo
    location ~* \.(css|js|jpg|jpeg|png|gif|ico|svg|woff|woff2|ttf|eot)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
    
    # Denegar acceso a archivos sensibles
    location ~ /\. {
        deny all;
    }
    
    location ~ /(config|logs|backups|database)/ {
        deny all;
    }
    
    # Fallback
    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }
}