# Database — direct local connection (no SSH tunnel in production)
DATABASE_URL="mysql://dbuser:dbpassword@127.0.0.1:3306/osztromok"

# NextAuth
AUTH_SECRET="your-64-char-secret-from-npx-auth-secret"
NEXTAUTH_URL="https://osztromok.com"

# Admin credentials
ADMIN_USERNAME="admin"
ADMIN_PASSWORD_HASH="$2a$12$your-bcrypt-hash"

# ISR on-demand revalidation
REVALIDATE_TOKEN="your-random-hex-token"

# Used in kanji page for fetch() calls to our own API
NEXT_PUBLIC_SITE_URL="https://osztromok.com"

# Disable Prisma query logging in production
NODE_ENV="production"

module.exports = {
  apps: [{
    name:         'osztromok-next',
    script:       'node_modules/.bin/next',
    args:         'start',
    cwd:          '/var/www/osztromok-next',
    instances:    1,          // 1 instance — scale up if needed
    exec_mode:    'fork',
    env: {
      PORT:       3000,
      NODE_ENV:   'production',
    },
    // Log files
    out_file:     './logs/out.log',
    error_file:   './logs/error.log',
    log_date_format: 'YYYY-MM-DD HH:mm:ss',
    max_memory_restart: '512M',  // restart if memory exceeds 512 MB
  }],
}

# Redirect HTTP → HTTPS
server {
    listen 80;
    server_name osztromok.com www.osztromok.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name osztromok.com www.osztromok.com;

    # SSL — managed by Certbot (Let's Encrypt)
    ssl_certificate     /etc/letsencrypt/live/osztromok.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/osztromok.com/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # ── Serve Next.js static assets directly from disk ──────────────
    # Bypasses Node.js entirely for CSS/JS/images — much faster
    location /_next/static/ {
        alias /var/www/osztromok-next/.next/static/;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }

    # ── Serve files from /public directly ────────────────────────
    location /resources/ {
        alias /var/www/osztromok-next/public/resources/;
        expires 7d;
    }

    # ── Everything else → Next.js on port 3000 ─────────────────
    location / {
        proxy_pass         http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade    $http_upgrade;
        proxy_set_header   Connection 'upgrade';
        proxy_set_header   Host       $host;
        proxy_set_header   X-Real-IP  $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;

        # Give Next.js up to 60s to respond (ISR rebuild can take a moment)
        proxy_read_timeout 60s;
    }
}