# ============================================================================
# Configuracao Nginx - Avanzato Tecnologia
# ============================================================================
# Inclui: CSP, HSTS, X-Frame-Options, cache headers, gzip, brotli
# Copiar para: /etc/nginx/sites-available/avanzato.com.br
# Ativar: ln -s /etc/nginx/sites-available/avanzato.com.br /etc/nginx/sites-enabled/
# ============================================================================

server {
    listen 80;
    listen [::]:80;
    server_name avanzato.com.br www.avanzato.com.br;
    
    # Redirecionar HTTP para HTTPS
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name avanzato.com.br www.avanzato.com.br;

    # SSL (certbot gerencia automaticamente)
    ssl_certificate /etc/letsencrypt/live/avanzato.com.br/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/avanzato.com.br/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/avanzato.com.br/chain.pem;

    # SSL hardening
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # HSTS - HTTP Strict Transport Security
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # Root do projeto
    root /var/www/avanzato/dist;
    index index.html;

    # Gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml+rss
        application/atom+xml
        image/svg+xml
        font/woff2;

    # ============================================================================
    # CACHE HEADERS - Assets estaticos
    # ============================================================================
    
    # Imagens, fontes, videos - 1 mes
    location ~* \.(jpg|jpeg|png|gif|ico|svg|webp|woff|woff2|ttf|eot|mp4|webm)$ {
        expires 1M;
        add_header Cache-Control "public, immutable" always;
        add_header Vary "Accept-Encoding" always;
        access_log off;
    }

    # CSS e JS - 1 ano (tem hash no nome)
    location ~* \.(css|js)$ {
        expires 1y;
        add_header Cache-Control "public, immutable" always;
        add_header Vary "Accept-Encoding" always;
        access_log off;
    }

    # HTML - nao cachear
    location ~* \.html$ {
        expires -1;
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
        add_header Pragma "no-cache" always;
    }

    # ============================================================================
    # SECURITY HEADERS
    # ============================================================================
    
    # Content Security Policy
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.googletagmanager.com https://connect.facebook.net https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://dns.google https://crt.sh https://mkt.avanzato.com.br https://www.google-analytics.com https://www.facebook.com; frame-src 'self' https://mkt.avanzato.com.br; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests;" always;

    # X-Frame-Options - protecao contra clickjacking
    add_header X-Frame-Options "SAMEORIGIN" always;

    # X-Content-Type-Options
    add_header X-Content-Type-Options "nosniff" always;

    # Referrer Policy
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Permissions Policy
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=()" always;

    # Cross-Origin Opener Policy
    add_header Cross-Origin-Opener-Policy "same-origin" always;

    # Cross-Origin Resource Policy
    add_header Cross-Origin-Resource-Policy "cross-origin" always;

    # ============================================================================
    # REACT ROUTER - SPA fallback
    # ============================================================================
    
    location / {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
    }

    # Sitemap e robots - acessiveis
    location = /sitemap.xml {
        try_files $uri =404;
        add_header Content-Type "application/xml" always;
    }

    location = /robots.txt {
        try_files $uri =404;
        add_header Content-Type "text/plain" always;
    }
}