events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # Allow multi-angle item captures + voice note in one server action.
    # Phone photos run 3-5MB raw (sharp strips them server-side), so a single
    # capture can easily ship 10+ files. Keep this in sync with the Server
    # Actions bodySizeLimit in next.config.ts.
    client_max_body_size 200m;

    server {
        listen 443 ssl;
        server_name eorganize.etpics.com;

        ssl_certificate     /etc/ssl/eorganize.etpics.com/combined;
        ssl_certificate_key /etc/ssl/eorganize.etpics.com/combined;
        ssl_protocols       TLSv1.2 TLSv1.3;

        # If a plain HTTP request lands here (497), redirect to HTTPS.
        # Apache (cPanel) fronts 443 → 9543 internally; clients see plain 443.
        error_page 497 =301 https://$host$request_uri;

        location / {
            proxy_pass http://eorganize-app:3000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection 'upgrade';
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Host $http_host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_cache_bypass $http_upgrade;
            proxy_read_timeout 60s;
        }
    }
}