Configuration & Environment

# ── PostgreSQL ──
POSTGRES_DB=myapp_db
POSTGRES_USER=myapp_user
POSTGRES_PASSWORD=S3cur3P@ssw0rd!Change-This

# ── Redis ──
REDIS_PASSWORD=R3d1sP@ss!Change-This

# ── Connection Strings (cho ASP.NET) ──
DB_CONNECTION=Host=postgres;Port=5432;Database=myapp_db;Username=myapp_user;Password=S3cur3P@ssw0rd!Change-This
REDIS_CONNECTION=redis:6379,password=R3d1sP@ss!Change-This

# ── ASP.NET ──
ASPNETCORE_ENVIRONMENT=Production
JWT_SECRET=your-jwt-secret-key-at-least-32-chars
JWT_ISSUER=https://app.example.com

# ── Domain ──
DOMAIN=app.example.com

# Copy file này thành .env và điền giá trị thật
# cp .env.example .env

POSTGRES_DB=myapp_db
POSTGRES_USER=myapp_user
POSTGRES_PASSWORD=# Đặt password mạnh ở đây

REDIS_PASSWORD=# Đặt password mạnh ở đây

DB_CONNECTION=# Host=postgres;Port=5432;Database=...;Username=...;Password=...
REDIS_CONNECTION=# redis:6379,password=...

ASPNETCORE_ENVIRONMENT=Production
JWT_SECRET=# Ít nhất 32 ký tự
JWT_ISSUER=# https://your-domain.com
DOMAIN=# your-domain.com

// appsettings.json — giá trị mặc định cho development
{
  "ConnectionStrings": {
    "DefaultConnection": "Host=localhost;Port=5432;Database=myapp_dev"
  },
  "Redis": {
    "ConnectionString": "localhost:6379"
  },
  "Jwt": {
    "Secret": "dev-secret-not-for-production",
    "Issuer": "https://localhost:5001"
  }
}

# docker-compose.yml — override bằng env vars cho production
backend:
  environment:
    # Dấu __ (double underscore) thay cho : trong JSON hierarchy
    - ConnectionStrings__DefaultConnection=${DB_CONNECTION}
    - Redis__ConnectionString=${REDIS_CONNECTION}
    - Jwt__Secret=${JWT_SECRET}
    - Jwt__Issuer=${JWT_ISSUER}

# nginx/nginx.conf

events {
    worker_connections 1024;
}

http {
    # ── Upstream definitions ──
    upstream frontend {
        server frontend:80;
    }

    upstream backend {
        server backend:8080;
    }

    # ── Redirect HTTP → HTTPS ──
    server {
        listen 80;
        server_name app.example.com;
        return 301 https://$host$request_uri;
    }

    # ── Main HTTPS server ──
    server {
        listen 443 ssl;
        server_name app.example.com;

        # SSL certificates
        ssl_certificate     /etc/nginx/ssl/fullchain.pem;
        ssl_certificate_key /etc/nginx/ssl/privkey.pem;

        # SSL best practices
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

        # Security headers
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

        # ── API requests → Backend ──
        location /api/ {
            proxy_pass http://backend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Timeout cho long-running requests
            proxy_read_timeout 60s;
            proxy_send_timeout 60s;
        }

        # ── Everything else → Frontend ──
        location / {
            proxy_pass http://frontend;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # ── Gzip compression ──
        gzip on;
        gzip_types text/plain application/json application/javascript text/css;
        gzip_min_length 1000;
    }
}

// Program.cs
var builder = WebApplication.CreateBuilder(args);

// Cấu hình Forwarded Headers
builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor
                             | ForwardedHeaders.XForwardedProto;
    // Trust Nginx proxy (trong Docker network)
    options.KnownNetworks.Clear();
    options.KnownProxies.Clear();
});

var app = builder.Build();

// PHẢI đặt TRƯỚC các middleware khác
app.UseForwardedHeaders();

app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();

// Program.cs — Chỉ cần nếu frontend ở domain khác
builder.Services.AddCors(options =>
{
    options.AddPolicy("Production", policy =>
    {
        policy.WithOrigins("https://app.example.com")
              .AllowAnyMethod()
              .AllowAnyHeader()
              .AllowCredentials();
    });
});

// Sử dụng
app.UseCors("Production");