# Must be at server scope, not on an inner location: client_max_body_size
# does not inherit into a nested location that declares its own proxy_pass,
# and the http-level 1m default would silently apply and reject bundle
# uploads with 413.
client_max_body_size 256m;

location / {
    include /etc/nginx/webui-proxy.conf;
}

# burst=3 nodelay: three POSTs land back-to-back; the next needs a
# fresh token (~12 s at 5r/m) or 429s.
location = /login {
    limit_req zone=webui_login burst=3 nodelay;
    include /etc/nginx/webui-proxy.conf;
}

# Keep proxy_request_buffering on (the default). Streaming the body races
# the Go handler's response close, producing RST instead of FIN at
# Content-Length and a client-visible 502. nginx spools the body to
# /var/cache/nginx/client-body during the upload instead.
location = /software/upload {
    proxy_read_timeout 600s;
    include /etc/nginx/webui-proxy.conf;
}

# SSE progress stream: RAUC's Progress D-Bus property doesn't change while
# it's writing a slot, so the upstream goes minutes without a frame. The
# default 60 s proxy_read_timeout closes the stream and the browser sees
# a transient error. Raise to cover a slow image write end-to-end.
location = /software/progress {
    proxy_read_timeout 1800s;
    proxy_buffering off;
    include /etc/nginx/webui-proxy.conf;
}

# SSE live-tail stream for Maintenance > Logs.  Same buffering / timeout
# concerns as the software progress stream: nginx must not buffer the
# event frames, and the connection has to stay open through quiet logs.
# The Go side sends a 15 s heartbeat, so 600 s of read timeout is plenty
# of safety margin.
location ~ ^/maintenance/logs/[^/]+/tail$ {
    proxy_read_timeout 600s;
    proxy_buffering off;
    include /etc/nginx/webui-proxy.conf;
}

# Support bundle collection runs `support collect`, which emits nothing
# until it finishes (~50 s) and then sends the whole archive at once.
# The upstream is silent for that window, so the default 60 s
# proxy_read_timeout would 504 just as the bundle is ready.  Buffering
# stays on — it's a plain file download, not a stream.
location = /maintenance/support-bundle {
    proxy_read_timeout 300s;
    include /etc/nginx/webui-proxy.conf;
}

# On-device User's Guide: the mkdocs site bundled into the rootfs at
# /var/www/guide by post-build.sh.  Served as static files (no upstream
# call), public like the published guide.  Present only when the build
# host had mkdocs; the WebUI hides its User Guide entry when it's absent.
location /guide/ {
    alias /var/www/guide/;
    index index.html;
}

# Liveness probe — nginx-only, no upstream call. Used by the watchdog
# div in base.html and the reboot-overlay poller.
location = /device-status {
    access_log off;
    return 204;
}