# Reverse proxy for Card Grader. Replace card-grader.example.com below with
# your actual subdomain, point an A record at your Unraid box's public IP
# (or use a dynamic-DNS hostname if your ISP doesn't give you a static one),
# and forward ports 80 + 443 on your router to the Unraid box.

server {
    listen 80;
    server_name card-grader.example.com;

    # certbot's webroot plugin needs this path reachable over plain HTTP to
    # issue/renew the certificate; everything else redirects to HTTPS.
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    http2 on;
    server_name card-grader.example.com;

    ssl_certificate     /etc/letsencrypt/live/card-grader.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/card-grader.example.com/privkey.pem;

    # Grading uploads can be a few photos at once; app.py caps the combined
    # decoded size at 12MB, and base64 inflates that by ~33% on the wire —
    # give nginx enough headroom that it isn't the thing rejecting uploads.
    client_max_body_size 20m;

    location / {
        proxy_pass http://127.0.0.1:8778;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Grading calls out to Anthropic and can take a while on Opus/careful
        # effort; don't let nginx's default 60s read timeout cut it off.
        proxy_read_timeout 120s;
    }
}