apiVersion: v1
kind: ConfigMap
metadata:
  name: erpnext-config
  namespace: erpnext
data:
  # Database configuration for Azure Database for PostgreSQL
  DB_TYPE: "postgres"
  DB_HOST: "${DB_SERVER_NAME}.postgres.database.azure.com"
  DB_PORT: "5432"
  DB_NAME: "erpnext"
  DB_USER: "${DB_ADMIN_USER}"
  
  # Redis configuration for Azure Cache for Redis
  REDIS_HOST: "${REDIS_HOST}"
  REDIS_PORT: "6380"
  REDIS_USE_SSL: "true"
  
  # Azure Storage configuration
  STORAGE_ACCOUNT: "${STORAGE_ACCOUNT}"
  STORAGE_CONTAINER: "erpnext-files"
  STORAGE_BACKUP_CONTAINER: "erpnext-backups"
  
  # Application configuration
  FRAPPE_SITE_NAME_HEADER: "frontend"
  WORKER_CLASS: "gthread"
  GUNICORN_WORKERS: "4"
  GUNICORN_THREADS: "4"
  GUNICORN_TIMEOUT: "120"
  GUNICORN_LOGLEVEL: "info"
  
  # Environment settings
  ENVIRONMENT: "production"
  DEVELOPER_MODE: "0"
  ALLOW_TESTS: "0"
  
  # Performance settings
  REDIS_CACHE_EXPIRES_IN_SEC: "3600"
  REDIS_QUEUE_EXPIRES_IN_SEC: "604800"
  
  # Security settings
  ENCRYPTION_KEY: "${ENCRYPTION_KEY}"
  FORCE_HTTPS: "1"
  SESSION_COOKIE_SECURE: "1"
  
  # Monitoring
  ENABLE_MONITORING: "1"
  APPLICATIONINSIGHTS_CONNECTION_STRING: "InstrumentationKey=${INSTRUMENTATION_KEY}"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: erpnext
data:
  nginx.conf: |
    user nginx;
    worker_processes auto;
    error_log /var/log/nginx/error.log warn;
    pid /var/run/nginx.pid;

    events {
        worker_connections 4096;
        use epoll;
        multi_accept on;
    }

    http {
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" "$http_x_forwarded_for"';

        access_log /var/log/nginx/access.log main;

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        server_tokens off;

        # Compression
        gzip on;
        gzip_vary on;
        gzip_min_length 1024;
        gzip_types text/plain text/css text/xml text/javascript 
                   application/json application/javascript application/xml+rss;

        # Security headers
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;

        # Rate limiting
        limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
        limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

        upstream backend {
            least_conn;
            server erpnext-backend:8000 max_fails=3 fail_timeout=30s;
            keepalive 32;
        }

        upstream websocket {
            server erpnext-websocket:9000;
        }

        server {
            listen 8080;
            server_name _;
            root /usr/share/nginx/html;

            client_max_body_size 50M;
            client_body_buffer_size 16K;
            client_header_buffer_size 1K;
            large_client_header_buffers 4 16K;

            # Security
            location ~ /\. {
                deny all;
                access_log off;
                log_not_found off;
            }

            # Static files
            location /assets {
                alias /usr/share/nginx/html/assets;
                expires 7d;
                add_header Cache-Control "public, immutable";
            }

            location /files {
                alias /usr/share/nginx/html/files;
                expires 7d;
            }

            # WebSocket
            location /socket.io {
                proxy_pass http://websocket;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_read_timeout 86400;
            }

            # Application
            location / {
                limit_req zone=general burst=20 nodelay;
                
                proxy_pass http://backend;
                proxy_http_version 1.1;
                proxy_set_header Connection "";
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header X-Frappe-Site-Name frontend;
                
                proxy_connect_timeout 120s;
                proxy_send_timeout 120s;
                proxy_read_timeout 120s;
                
                proxy_buffer_size 4K;
                proxy_buffers 8 4K;
                proxy_busy_buffers_size 8K;
            }

            # Login rate limiting
            location ~ ^/(api/method/login|api/method/logout) {
                limit_req zone=login burst=5 nodelay;
                proxy_pass http://backend;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
            }

            # Health check
            location /health {
                access_log off;
                return 200 "healthy\n";
                add_header Content-Type text/plain;
            }
        }
    }