pfm-ocr/backend/nginx.conf

events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;

    map $http_x_forwarded_proto $proxy_x_forwarded_proto {
        default $http_x_forwarded_proto;
        ''      $scheme;
    }

    server {
        listen 80;
        server_name _; # accept any host — tunnel URLs, IPs, custom domains

        # Disable body size limit for large image/pdf base64 payloads
        client_max_body_size 0;

        # Route to Next.js API Gateway (default root)
        location / {
            proxy_pass http://paddleocr-pfm-web-app:3000;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }


        location /history {
            proxy_pass http://paddleocr-pfm-web-app:3000;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        location /arena {
            proxy_pass http://paddleocr-pfm-web-app:3000;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        location /gpu {
            proxy_pass http://paddleocr-pfm-web-app:3000;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        location /api {
            proxy_pass http://paddleocr-pfm-web-app:3000;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        location /_next {
            proxy_pass http://paddleocr-pfm-web-app:3000/_next;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        # Route to Pipeline API
        location /layout-parsing {
            proxy_pass http://paddleocr-pipeline-api:8090/layout-parsing;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        location /health {
            proxy_pass http://paddleocr-pipeline-api:8090/health;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
        }

        # Route to vLLM Server API (v1)
        location /v1 {
            proxy_pass http://paddleocr-vllm-server:8118/v1;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }
    }

    server {
        listen 8001;
        server_name _;

        client_max_body_size 0;

        # Secure public endpoint — only allow API v1 surface
        location /api/v1/ {
            proxy_pass http://paddleocr-pfm-web-app:3000/api/v1/;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
            proxy_read_timeout 300s;
            proxy_send_timeout 300s;
        }

        # Deny everything else
        location / {
            return 404;
        }
    }
}