# 0.2.1 TLS 前置: 单端口 13443, 按路径分流 (自签证书, 见 README)
# PowerSync 页面必须在安全上下文运行 (navigator.locks 仅 HTTPS/localhost), 故 app 与 sync 统一走 TLS
server {
    listen 443 ssl;
    server_name bh.vps.honor3.com;

    ssl_certificate     /etc/nginx/certs/bh.pem;
    ssl_certificate_key /etc/nginx/certs/bh.key;

    # PowerSync (HTTP 流式 + WebSocket 兜底)
    location /sync/ {
        proxy_pass http://powersync:8080;
        proxy_http_version 1.1;
        proxy_set_header Connection '';
        proxy_buffering off;
        proxy_read_timeout 3600s;
    }
    location /socket/ {
        proxy_pass http://powersync:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
    }
    location /health {
        proxy_pass http://powersync:8080;
    }

    # 应用 (静态前端 + API)
    location / {
        proxy_pass http://app:13001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}