events {
    worker_connections 1024;
}

http {
    upstream immich {
        server immich_server:2283;
    }

    server {
        listen 443 ssl;
        server_name bee8333.ddns.net;

        # Self-signed SSL certificate (will be generated at startup)
        ssl_certificate /etc/ssl/certs/immich.crt;
        ssl_certificate_key /etc/ssl/private/immich.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;

        client_max_body_size 50000M;

        # Direct proxy to Immich - NO subpath manipulation
        location / {
            proxy_pass http://immich;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            
            # WebSocket support for real-time features
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }
}