resolver 127.0.0.11 valid=300s ipv6=off;
resolver_timeout 5s;

# 1. Gitea (git.irfartak.com) - HTTP
server {
    listen 80;
    server_name git.irfartak.com;
    client_max_body_size 512M;

    location / {
        set $upstream_gitea http://gitea-srv:3000;
        proxy_pass $upstream_gitea;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 2. Gitea (git.irfartak.com) - HTTPS
server {
    listen 443 ssl;
    server_name git.irfartak.com;

    ssl_certificate     /etc/nginx/certs-git/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs-git/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    client_max_body_size 512M;

    location / {
        set $upstream_gitea http://gitea-srv:3000;
        proxy_pass $upstream_gitea;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# 3. Statista (statista.steelforesight.ir) - HTTP
server {
    listen 80;
    server_name statista.steelforesight.ir;

    location /api/ {
        set $upstream_backend http://statista-backend-1:8000;
        proxy_pass $upstream_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /ws/ {
        set $upstream_backend http://statista-backend-1:8000;
        proxy_pass $upstream_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Smart Routing for root /:
    # If request has Authorization header OR query param token/api_token, serve JSON data (/api/tree).
    # Otherwise, if it is a normal browser visit, serve React Dashboard UI.
    location = / {
        set $backend_target "0";
        if ($http_authorization ~* ".+") {
            set $backend_target "1";
        }
        if ($arg_api_token ~* ".+") {
            set $backend_target "1";
        }
        if ($arg_token ~* ".+") {
            set $backend_target "1";
        }
        if ($http_accept ~* "application/json") {
            set $backend_target "1";
        }

        if ($backend_target = "1") {
            rewrite ^ /api/tree break;
            proxy_pass http://statista-backend-1:8000;
        }

        set $upstream_frontend http://statista-frontend-1:3000;
        proxy_pass $upstream_frontend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        set $upstream_frontend http://statista-frontend-1:3000;
        proxy_pass $upstream_frontend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 4. Statista (statista.steelforesight.ir) - HTTPS (Port 443)
server {
    listen 443 ssl;
    server_name statista.steelforesight.ir;

    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location /api/ {
        set $upstream_backend http://statista-backend-1:8000;
        proxy_pass $upstream_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    location /ws/ {
        set $upstream_backend http://statista-backend-1:8000;
        proxy_pass $upstream_backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    # Smart Routing for root /:
    # If request has Authorization header OR query param token/api_token, serve JSON data (/api/tree).
    # Otherwise, if it is a normal browser visit, serve React Dashboard UI.
    location = / {
        set $backend_target "0";
        if ($http_authorization ~* ".+") {
            set $backend_target "1";
        }
        if ($arg_api_token ~* ".+") {
            set $backend_target "1";
        }
        if ($arg_token ~* ".+") {
            set $backend_target "1";
        }
        if ($http_accept ~* "application/json") {
            set $backend_target "1";
        }

        if ($backend_target = "1") {
            rewrite ^ /api/tree break;
            proxy_pass http://statista-backend-1:8000;
        }

        set $upstream_frontend http://statista-frontend-1:3000;
        proxy_pass $upstream_frontend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    location / {
        set $upstream_frontend http://statista-frontend-1:3000;
        proxy_pass $upstream_frontend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# 5. Iranian Futurist Main Portal
server {
    listen 80;
    server_name iranianfuturist.com www.iranianfuturist.com;

    location / {
        set $upstream_if http://if-react-frontend:80;
        proxy_pass $upstream_if;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 6. IRFartak
server {
    listen 80;
    server_name irfartak.com www.irfartak.com;

    location /api/ {
        set $upstream_fartak_api http://irfartak-backend-1:3000;
        proxy_pass $upstream_fartak_api;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        set $upstream_fartak_fe http://irfartak-frontend-1:3000;
        proxy_pass $upstream_fartak_fe;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 7. Default Fallback Server
server {
    listen 80 default_server;
    server_name _;

    location /statista-api/ {
        rewrite ^/statista-api/(.*)$ /api/$1 break;
        set $upstream_backend http://statista-backend-1:8000;
        proxy_pass $upstream_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        set $upstream_if http://if-react-frontend:80;
        proxy_pass $upstream_if;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}


# Iranian Futurist - HTTPS
server {
    listen 443 ssl;
    server_name iranianfuturist.com www.iranianfuturist.com;

    ssl_certificate     /etc/nginx/certs-git/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs-git/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        set $upstream_if http://if-react-frontend:80;
        proxy_pass $upstream_if;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# 6b. IRFartak .com HTTPS
server {
    listen 443 ssl;
    server_name irfartak.com www.irfartak.com;
    ssl_certificate     /etc/nginx/certs-git/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs-git/privkey.pem;
    location / {
        set $up_a http://irfartak-frontend-1:3000;
        proxy_pass $up_a;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 6c. IRFartak .ir HTTP
server {
    listen 80;
    server_name irfartak.ir www.irfartak.ir;
    location / {
        set $up_b http://irfartak-frontend-1:3000;
        proxy_pass $up_b;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 6d. IRFartak .ir HTTPS
server {
    listen 443 ssl;
    server_name irfartak.ir www.irfartak.ir;
    ssl_certificate     /etc/nginx/certs-git/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs-git/privkey.pem;
    location / {
        set $up_c http://irfartak-frontend-1:3000;
        proxy_pass $up_c;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# 9. TLS catch-all - unknown SNI must not land on Gitea
server {
    listen 443 ssl default_server;
    server_name _;
    ssl_certificate     /etc/nginx/certs-git/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs-git/privkey.pem;
    return 444;

}
    # --- CMS (Directus) ---
    server {
        listen 80;
        server_name cms.irfartak.com;

        location /.well-known/acme-challenge/ {
            root /var/www/certbot;
            default_type "text/plain";
        }

        location / {
            resolver 127.0.0.11 valid=30s;
            set $upstream_cms http://cms:8055;
            proxy_pass $upstream_cms;
            proxy_http_version 1.1;
            client_max_body_size 100m;
            proxy_read_timeout 300s;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    # --- CMS (Directus) HTTPS ---
    server {
        listen 443 ssl;
        server_name cms.irfartak.com;

        ssl_certificate     /etc/nginx/certs/cms/fullchain.pem;
        ssl_certificate_key /etc/nginx/certs/cms/privkey.pem;

        location / {
            resolver 127.0.0.11 valid=30s;
            set $upstream_cms_s http://cms:8055;
            proxy_pass $upstream_cms_s;
            proxy_http_version 1.1;
            client_max_body_size 100m;
            proxy_read_timeout 300s;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
        }
    }