# Verbatim /etc/nginx/conf.d/http.conf from gateway-ops, read read-only over the ssh key by
# ./scripts/capture-gateway-config.sh (AGENTS.md invariant 7: verify against the
# deployed upstream, never guess its shape).
# Nothing here is rewritten: it is this fleet's ingress map, and the domains in it are
# the data — an inbound name and the target it routes to are what these config sections
# exist to report. Key material appears only as the file paths the proxy reads.
server {
    listen 4443 ssl proxy_protocol;
    listen [::]:4443 ssl proxy_protocol;
    server_name nextcloud.reeseapps.com;
    client_max_body_size 0;

    ssl_certificate /etc/letsencrypt/live/nextcloud.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nextcloud.reeseapps.com/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://nextcloud.reeselink.com:11000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 8443 ssl;
    listen [::]:8443 ssl;
    server_name nextcloud.reeseapps.com;
    client_max_body_size 0;

    ssl_certificate /etc/letsencrypt/live/nextcloud.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/nextcloud.reeseapps.com/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://nextcloud.reeselink.com:11001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 4443 ssl proxy_protocol;
    listen [::]:4443 ssl proxy_protocol;
    server_name gitea.reeseapps.com;
    client_max_body_size 0;

    ssl_certificate /etc/letsencrypt/live/gitea.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/gitea.reeseapps.com/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://gitea.reeselink.com:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 4443 ssl proxy_protocol;
    listen [::]:4443 ssl proxy_protocol;
    server_name jellyfin.reeseapps.com;
    client_max_body_size 0;

    ssl_certificate /etc/letsencrypt/live/jellyfin.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/jellyfin.reeseapps.com/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://jellyfin.reeselink.com:8096;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 8443 ssl;
    listen [::]:8443 ssl;
    server_name alicia-ai-terminology.reeseapps.com;

    ssl_certificate /etc/letsencrypt/live/alicia-ai-terminology.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/alicia-ai-terminology.reeseapps.com/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://127.0.0.1:8081;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 4443 ssl proxy_protocol;
    listen [::]:4443 ssl proxy_protocol;
    server_name connors-legos.reeseapps.com;

    ssl_certificate /etc/letsencrypt/live/connors-legos.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/connors-legos.reeseapps.com/privkey.pem;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://bricktracker.reeselink.com:3333;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 4443 ssl proxy_protocol;
    listen [::]:4443 ssl proxy_protocol;
    server_name keycloak.reeseapps.com;
    client_max_body_size 0;

    ssl_certificate /etc/letsencrypt/live/keycloak.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/keycloak.reeseapps.com/privkey.pem;

    location / {
        proxy_pass http://keycloak.reeselink.com:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

server {
    listen 8443 ssl;
    listen [::]:8443 ssl;
    server_name admin.keycloak.reeseapps.com;
    client_max_body_size 0;

    ssl_certificate /etc/letsencrypt/live/admin.keycloak.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/admin.keycloak.reeseapps.com/privkey.pem;

    location / {
        proxy_pass http://keycloak.reeselink.com:8080;
        proxy_set_header Host $host:$server_port;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-Forwarded-Host $host:$server_port;
    }
}

server {
    listen 4443 ssl proxy_protocol;
    listen [::]:4443 ssl proxy_protocol;
    server_name emmaleaf.reeseapps.com;
    client_max_body_size 10m;

    ssl_certificate /etc/letsencrypt/live/emmaleaf.reeseapps.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/emmaleaf.reeseapps.com/privkey.pem;

    location / {
        proxy_pass http://emmaleaf.reeselink.com:80;
        proxy_ssl_verify       off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}