# 只修改 upstream 的 nginx 配置
# 将 wecom_it_backend 改为 wecom_it_backend_green

events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent"';

    access_log /var/log/nginx/access.log main;
    error_log  /var/log/nginx/error.log warn;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;

    # 真实 IP 还原
    set_real_ip_from 10.0.0.0/8;
    set_real_ip_from 172.16.0.0/12;
    set_real_ip_from 192.168.0.0/16;
    set_real_ip_from 10.212.0.0/16;
    real_ip_header    X-Forwarded-For;
    real_ip_recursive on;

    # Gzip
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml;

    # ========================================================================
    # UPSTREAM — 改为 Green 环境
    # ========================================================================
    upstream wecom_it_backend {
        server wecom_it_backend_green:8000;
    }

    # 默认服务器
    server {
        listen 80 default_server;
        server_name localhost;

        root /usr/share/nginx/html;
        index index.html;

        # itdesk H5
        location /itdesk/ {
            alias /usr/share/nginx/html/itdesk/;
            try_files $uri /itdesk/index.html;
        }

        # itagent 坐席
        location /itagent/ {
            alias /usr/share/nginx/html/itagent/;
            try_files $uri /itagent/index.html;
        }

        # itadmin 管理后台
        location /itadmin/ {
            alias /usr/share/nginx/html/itadmin/;
            try_files $uri /itadmin/index.html;
        }
        # ⚠️ /itportal/ 静态前端块已移除 (2026-08-03 fix) - portal 源码 + dist 已不存在

        # API — Green 后端
        location /api/ {
            # 管理端 API 需要 IP 白名单
            location ~ ^/api/admin/ {
                allow 10.0.0.0/8;
                allow 172.16.0.0/12;
                allow 192.168.0.0/16;
                allow 10.212.0.0/16;
                deny all;
                proxy_pass http://wecom_it_backend;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_connect_timeout 60s;
                proxy_send_timeout 300s;
                proxy_read_timeout 300s;
            }

            # 其他 API
            proxy_pass http://wecom_it_backend/;
            proxy_http_version 1.1;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Connection "";
            proxy_connect_timeout 60s;
            proxy_send_timeout 300s;
            proxy_read_timeout 300s;
        }

        # WebSocket
        location /ws/ {
            access_log off;
            proxy_pass http://wecom_it_backend;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_read_timeout 86400s;
        }

        # 根路径重定向（2026-08-03 fix: /itportal/ → /itdesk/，因 portal 已下线）
        location = / {
            return 302 /itdesk/;
        }
    }
}