# nginx gateway terpadu — docker-socket-proxy + config-agent dalam SATU port.
#
# Template: docker-entrypoint nginx men-substitute ${GATEWAY_API_KEY} saat start
# (variabel nginx seperti $http_x_api_key TIDAK ikut diganti), lalu menulis hasil
# ke /etc/nginx/conf.d/default.conf.
#
# Kebijakan:
#   * Semua request WAJIB membawa header `X-Api-Key` == GATEWAY_API_KEY (401 bila
#     salah/kosong), SEBELUM diproses location mana pun.
#   * Allowlist path ketat:
#       - /_ping /version /info /events /containers/*   → docker-proxy:2375
#       - /healthz /env /dbt /ca /catalog(/<name>) /opa/data /services/scan → config-agent:8080
#     Selain daftar → 403.
#   * Aksi container restart/start/stop hanya POST (selainnya 405).
#   * Katalog (cart agent) mengizinkan GET/PUT/DELETE.
#
# Lihat: docs/desain-host-gateway-terpadu.md

server {
    listen 80 default_server;
    server_name _;

    # ==== API-key check (sebelum location mana pun) ====
    if ($http_x_api_key != "${GATEWAY_API_KEY}") {
        return 401;
    }

    # ==== config-agent (konfigurasi platform) ====
    location = /healthz { proxy_pass http://config-agent:8080; }
    location = /env     { proxy_pass http://config-agent:8080; }
    location = /dbt     { proxy_pass http://config-agent:8080; }
    location = /ca      { proxy_pass http://config-agent:8080; }
    location = /catalog { proxy_pass http://config-agent:8080; }
    # GET/PUT/DELETE satu katalog (tanpa slash tambahan di nama).
    location ~ ^/catalog/[^/]+$ { proxy_pass http://config-agent:8080; }
    # Dokumen data OPA (menu Authorization) — baca sekarang, tulis menyusul.
    location = /opa/data { proxy_pass http://config-agent:8080; }
    # Scan service (panel-driven) — memindai container host lewat docker-proxy.
    location = /services/scan { proxy_pass http://config-agent:8080; }

    # ==== docker-socket-proxy (Docker Engine API) ====
    location = /_ping   { proxy_pass http://docker-proxy:2375; }
    location = /version { proxy_pass http://docker-proxy:2375; }
    location = /info    { proxy_pass http://docker-proxy:2375; }
    location = /events  { proxy_pass http://docker-proxy:2375; }

    location = /containers/json { proxy_pass http://docker-proxy:2375; }

    location ~ ^/containers/[^/]+/json$  { proxy_pass http://docker-proxy:2375; }
    location ~ ^/containers/[^/]+/logs$  { proxy_pass http://docker-proxy:2375; }
    location ~ ^/containers/[^/]+/stats$ { proxy_pass http://docker-proxy:2375; }
    location ~ ^/containers/[^/]+/top$   { proxy_pass http://docker-proxy:2375; }

    # Aksi tulis container — hanya POST.
    location ~ ^/containers/[^/]+/(restart|start|stop)$ {
        if ($request_method != POST) {
            return 405;
        }
        proxy_pass http://docker-proxy:2375;
    }

    # ==== selain allowlist → tolak ====
    location / {
        return 403;
    }
}