events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 65;

    upstream router_api { server router:9000; }
    upstream dashboard_ui { server dashboard:3000; }
    upstream litellm_backend { server litellm:4000; }

    server {
        listen 80;

        # Authentik OIDC subrequest
        location /authentik/auth {
            internal;
            proxy_pass https://auth.sysloggh.net/outpost.goauthentik.io/auth/nginx;
            proxy_pass_request_body off;
            proxy_set_header Content-Length "";
            proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        # 2-Layer: LiteLLM (Layer 1) -> Router (Layer 2) -> GPUs
        # /v1/ routes to router (all existing keys work)
        # Agents using new LiteLLM keys: change OPENAI_API_BASE to /litellm/v1
        location /v1/ {
            proxy_pass http://router_api;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Authorization $http_authorization;
            proxy_connect_timeout 10s;
            proxy_read_timeout 600s;
            proxy_buffering off;
            error_page 502 503 = @router_fallback;
        }

        location @router_fallback {
            proxy_pass http://router_api;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Authorization $http_authorization;
            proxy_read_timeout 600s;
        }

        location /admin/ {
            proxy_pass http://router_api;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Authorization $http_authorization;
            proxy_read_timeout 600s;
        }

        location /stream {
            proxy_pass http://router_api/stream;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_buffering off;
        }

        location /api/ {
            proxy_pass http://router_api/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        # LiteLLM gateway access (for agents with new virtual keys)
        location /litellm/v1/ {
            proxy_pass http://litellm_backend/v1/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header Authorization $http_authorization;
            proxy_connect_timeout 10s;
            proxy_read_timeout 600s;
            proxy_buffering off;
        }

        # LiteLLM UI static assets
        location /litellm-asset-prefix/ {
            proxy_pass http://litellm_backend/litellm-asset-prefix/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        # LiteLLM Admin UI (WebSocket support for live updates)
        location /litellm/ {
            proxy_pass http://litellm_backend/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_read_timeout 86400s;
            proxy_buffering off;
            # Rewrite all redirects to include /litellm/ prefix
            proxy_redirect http://172.18.0.7:4000/ /litellm/;
            proxy_redirect http://127.0.0.1:4000/ /litellm/;
        }

        location /dashboard/ {
            proxy_pass http://dashboard_ui/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        location / {
            root /opt/inference-harness/dashboard;
            try_files $uri $uri/ /index.html;
        }

        location /metrics/ {
            proxy_pass http://router_api/metrics/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        location /metrics/circuit-breaker {
            proxy_pass http://router_api/metrics/circuit-breaker;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        location /router/ {
            proxy_pass http://router_api/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        location /ui/ {
            return 302 http://192.168.68.116:4000/ui/;
        }

        location /health/unified {
            proxy_pass http://router_api/health/unified;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }

        location /ui/ {
            return 302 http://192.168.68.116:4000/ui/;
        }

        location /health {
            proxy_pass http://router_api/health;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
        }
    }
}