# Canonical host and HTTPS redirects. Replace certificate paths before applying.
server {
    listen 80;
    server_name cloudpure.cn www.cloudpure.cn;
    return 301 https://www.cloudpure.cn$request_uri;
}

server {
    listen 443 ssl http2;
    server_name cloudpure.cn;
    ssl_certificate /etc/nginx/certs/cloudpure.cn.pem;
    ssl_certificate_key /etc/nginx/certs/cloudpure.cn.key;
    return 301 https://www.cloudpure.cn$request_uri;
}

server {
    listen 443 ssl http2;
    server_name www.cloudpure.cn;
    root /opt/web/dist;
    index index.html;

    ssl_certificate /etc/nginx/certs/cloudpure.cn.pem;
    ssl_certificate_key /etc/nginx/certs/cloudpure.cn.key;

    location = / {
        try_files /home/index.html =404;
    }

    location ~ ^/(home|product/(version-selection|intelligent-hr|intelligent-recruitment|intelligent-attendance|dingtalk-payroll|dingtalk-yida|teambition|intelligent-finance|intelligent-contract|intelligent-marketing)|ai|fde|digital-base|organization-digital|business-digital|solutions|cases|super-service|about|contact|privacy-policy|news)$ {
        return 301 $uri/$is_args$args;
    }

    # Serve the pre-rendered public pages, preserving their static 200 responses.
    location ~ ^/(home|product/(version-selection|intelligent-hr|intelligent-recruitment|intelligent-attendance|dingtalk-payroll|dingtalk-yida|teambition|intelligent-finance|intelligent-contract|intelligent-marketing)|ai|fde|digital-base|organization-digital|business-digital|solutions|cases|super-service|about|contact|privacy-policy|news)/?$ {
        try_files $uri $uri/ /$1/index.html =404;
    }

    location = /order-tai { return 301 /ai/; }
    location = /order-tai/ { return 301 /ai/; }

    # Keep pre-rendered article HTML when it exists. Fall back to the SPA so
    # newly published articles can load by slug before the next prerender.
    location = /news/test { return 404; }
    location = /news/test/ { return 404; }
    location ~ ^/news/article-fe2a72(?:[^/]*)?$ { return 404; }
    location ~ ^/news/article-fe2a72(?:[^/]*)?/$ { return 404; }
    location ~ ^/news/[^/]+$ { return 301 $uri/$is_args$args; }
    location ~ ^/news/[^/]+/$ { try_files $uri $uri/ /index.html; }

    location = /robots.txt { try_files $uri =404; }
    location = /sitemap.xml { try_files $uri =404; }
    location /static/ { try_files $uri =404; expires 30d; }

    # Normalize all other public page URLs without a trailing slash. API,
    # admin, assets, uploads, and file-like URLs are intentionally excluded.
    location ~ ^/(?!prod-api(?:/|$)|admin(?:/|$)|static(?:/|$)|profile(?:/|$)|yunpubullet(?:/|$)|robots\.txt$|sitemap\.xml$)(?:[^/]+/)*[^/.]+$ {
        return 301 $uri/$is_args$args;
    }

    # Do not return the SPA shell for arbitrary paths: crawlers must receive a real 404.
    location / {
        try_files $uri $uri/ =404;
    }
}