# =============================================================================
# AVANZATO TECNOLOGIA - Configuração Nginx
# =============================================================================
# Coloque este arquivo em: /etc/nginx/sites-available/avanzato
# Depois crie link: sudo ln -s /etc/nginx/sites-available/avanzato /etc/nginx/sites-enabled/
# =============================================================================

server {
    # Portas HTTP e HTTPS
    listen 80;
    # listen 443 ssl http2;  # Descomente quando tiver SSL
    
    # Domínio
    server_name avanzato.com.br www.avanzato.com.br;
    
    # Pasta raiz do site
    root /var/www/avanzato/dist;
    index index.html;
    
    # Charset
    charset utf-8;
    
    # -------------------------------------------------------------------------
    # LOGS
    # -------------------------------------------------------------------------
    access_log /var/log/nginx/avanzato-access.log;
    error_log /var/log/nginx/avanzato-error.log;
    
    # -------------------------------------------------------------------------
    # GZIP (compressão)
    # -------------------------------------------------------------------------
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml+rss
        application/atom+xml
        image/svg+xml;
    
    # -------------------------------------------------------------------------
    # CACHE DE BROWSER
    # -------------------------------------------------------------------------
    # Assets com hash (JS/CSS) - cache longo
    location ~* \.(js|css)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header Vary "Accept-Encoding";
    }
    
    # Imagens - cache médio
    location ~* \.(png|jpg|jpeg|gif|ico|svg|webp)$ {
        expires 6M;
        add_header Cache-Control "public";
        add_header Vary "Accept-Encoding";
    }
    
    # Fontes - cache longo
    location ~* \.(woff|woff2|ttf|otf|eot)$ {
        expires 1y;
        add_header Cache-Control "public";
        add_header Vary "Accept-Encoding";
    }
    
    # HTML - sem cache
    location ~* \.html$ {
        expires -1;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
    }
    
    # -------------------------------------------------------------------------
    # SEGURANÇA - HEADERS
    # -------------------------------------------------------------------------
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # Content Security Policy (ajuste conforme necessário)
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-src https://api.whatsapp.com;" always;
    
    # HSTS (descomente quando tiver SSL)
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    
    # -------------------------------------------------------------------------
    # REGRAS DE SEGURANÇA
    # -------------------------------------------------------------------------
    # Bloquear arquivos ocultos
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
    
    # Bloquear arquivos de backup/sensíveis
    location ~* \.(git|gitignore|env|log|sql|sh|bash|zsh|bak|backup|swp|tmp)$ {
        deny all;
        access_log off;
        log_not_found off;
    }
    
    # Proteger arquivos de configuração
    location ~* \.(htaccess|htpasswd|ini|conf)$ {
        deny all;
        access_log off;
        log_not_found off;
    }
    
    # -------------------------------------------------------------------------
    # SPA - Single Page Application (React)
    # -------------------------------------------------------------------------
    # Tentar arquivo estático, senão vai para index.html
    location / {
        try_files $uri $uri/ /index.html;
    }
    
    # -------------------------------------------------------------------------
    # REDIRECIONAMENTOS
    # -------------------------------------------------------------------------
    # Forçar HTTPS (descomente quando tiver SSL)
    # if ($scheme != "https") {
    #     return 301 https://$host$request_uri;
    # }
    
    # Remover www (opcional)
    # if ($host ~* ^www\.(.*)$) {
    #     return 301 https://$1$request_uri;
    # }
    
    # -------------------------------------------------------------------------
    # PÁGINAS DE ERRO PERSONALIZADAS
    # -------------------------------------------------------------------------
    error_page 404 /index.html;
    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /var/www/avanzato/dist;
        internal;
    }
    
    # -------------------------------------------------------------------------
    # LIMITE DE TAMANHO DE UPLOAD
    # -------------------------------------------------------------------------
    client_max_body_size 10M;
    
    # -------------------------------------------------------------------------
    # TIMEOUTS
    # -------------------------------------------------------------------------
    client_body_timeout 12;
    client_header_timeout 12;
    keepalive_timeout 15;
    send_timeout 10;
}

# =============================================================================
# REDIRECIONAMENTO WWW (opcional)
# =============================================================================
# Se quiser forçar sem www:
# server {
#     listen 80;
#     server_name www.avanzato.com.br;
#     return 301 $scheme://avanzato.com.br$request_uri;
# }