# Nginx 反向代理示例：/etc/nginx/conf.d/hookpilot.conf
# 证书可使用 certbot 等工具申请，替换 hooks.example.com 与证书路径

server {
    listen 80;
    server_name hooks.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name hooks.example.com;

    ssl_certificate     /etc/letsencrypt/live/hooks.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/hooks.example.com/privkey.pem;

    # 与 HOOKPILOT_BODY_LIMIT 保持一致或略大
    client_max_body_size 2m;

    # 不在访问日志中记录 query（?token= 方式调用时避免 Token 落盘）
    log_format hookpilot '$remote_addr - [$time_local] "$request_method $uri" $status $body_bytes_sent';
    access_log /var/log/nginx/hookpilot.access.log hookpilot;

    location / {
        proxy_pass http://127.0.0.1:8787;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;

        # 同步模式会等待脚本执行结束，超时时间应大于最长的脚本超时 + 排队时间
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }
}