apiVersion: v1
kind: ConfigMap
metadata:
  name: savepal-backend-config
  namespace: savepal-production
  labels:
    app: savepal-backend
    component: config
    environment: production
data:
  NODE_ENV: "production"
  PORT: "4100"
  REDIS_PORT: "6379"
  REDIS_DB: "0"
  AWS_REGION: "us-east-1"
  
  # API Configuration
  API_VERSION: "v1"
  API_PREFIX: "/api/v1"
  
  # Rate Limiting
  THROTTLE_TTL: "60"
  THROTTLE_LIMIT: "100"
  
  # File Upload
  MAX_FILE_SIZE: "10485760" # 10MB
  ALLOWED_FILE_TYPES: "image/jpeg,image/png,image/gif,image/webp"
  
  # AI Configuration
  HUGGINGFACE_MODEL_CACHE_TTL: "3600"
  OPENROUTER_CACHE_TTL: "1800"
  ANTHROPIC_CACHE_TTL: "1800"
  
  # Database Configuration
  DB_CONNECTION_POOL_SIZE: "10"
  DB_CONNECTION_TIMEOUT: "5000"
  DB_SOCKET_TIMEOUT: "45000"
  
  # Monitoring
  METRICS_ENABLED: "true"
  HEALTH_CHECK_ENABLED: "true"
  
  # Logging
  LOG_LEVEL: "info"
  LOG_FORMAT: "json"
  
  # CORS Configuration
  CORS_ORIGIN: "https://savepal.ai,https://app.savepal.ai,https://admin.savepal.ai"
  CORS_METHODS: "GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS"
  CORS_CREDENTIALS: "true"

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: savepal-nginx-config
  namespace: savepal-production
  labels:
    app: savepal-nginx
    component: config
    environment: production
data:
  nginx.conf: |
    user nginx;
    worker_processes auto;
    error_log /var/log/nginx/error.log warn;
    pid /var/run/nginx.pid;

    events {
        worker_connections 1024;
        use epoll;
        multi_accept on;
    }

    http {
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        # Logging
        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for" '
                       'rt=$request_time uct="$upstream_connect_time" '
                       'uht="$upstream_header_time" urt="$upstream_response_time"';

        access_log /var/log/nginx/access.log main;

        # Performance
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        client_max_body_size 10M;

        # Gzip
        gzip on;
        gzip_vary on;
        gzip_min_length 1024;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_types
            text/plain
            text/css
            text/xml
            text/javascript
            application/json
            application/javascript
            application/xml+rss
            application/atom+xml
            image/svg+xml;

        # Rate limiting
        limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s;
        limit_req_zone $binary_remote_addr zone=auth:10m rate=5r/s;

        # Upstream backend
        upstream savepal_backend {
            least_conn;
            server savepal-backend-service:4100 max_fails=3 fail_timeout=30s;
            keepalive 32;
        }

        # Main server block
        server {
            listen 80;
            server_name api.savepal.ai;
            
            # Redirect HTTP to HTTPS
            return 301 https://$server_name$request_uri;
        }

        server {
            listen 443 ssl http2;
            server_name api.savepal.ai;

            # SSL Configuration
            ssl_certificate /etc/nginx/ssl/savepal.ai.crt;
            ssl_certificate_key /etc/nginx/ssl/savepal.ai.key;
            ssl_protocols TLSv1.2 TLSv1.3;
            ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384;
            ssl_prefer_server_ciphers off;
            ssl_session_cache shared:SSL:10m;
            ssl_session_timeout 10m;

            # Security headers
            add_header X-Frame-Options DENY;
            add_header X-Content-Type-Options nosniff;
            add_header X-XSS-Protection "1; mode=block";
            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

            # Health check endpoint
            location /health {
                access_log off;
                proxy_pass http://savepal_backend;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
            }

            # API endpoints
            location /api/ {
                limit_req zone=api burst=20 nodelay;
                
                proxy_pass http://savepal_backend;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                
                proxy_connect_timeout 5s;
                proxy_send_timeout 60s;
                proxy_read_timeout 60s;
                
                proxy_buffer_size 4k;
                proxy_buffers 8 4k;
                proxy_busy_buffers_size 8k;
            }

            # Authentication endpoints (stricter rate limiting)
            location /api/v1/auth/ {
                limit_req zone=auth burst=10 nodelay;
                
                proxy_pass http://savepal_backend;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
            }

            # Static files and documentation
            location /docs/ {
                proxy_pass http://savepal_backend;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
            }

            # Metrics endpoint (restricted access)
            location /metrics {
                allow 10.0.0.0/8;
                allow 172.16.0.0/12;
                allow 192.168.0.0/16;
                deny all;
                
                proxy_pass http://savepal_backend;
                proxy_set_header Host $host;
            }
        }
    }
