# nginx Reverse Proxy Konfiguration
# Pfad auf VPS: C:\nginx\conf\nginx.conf
# Server: Windows VPS 217.154.65.205

worker_processes 1;

events {
    worker_connections 1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile      on;
    keepalive_timeout 65;
    client_max_body_size 10G;
    server_names_hash_bucket_size 64;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;

    # Rate Limiting
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;

    # ============================================
    # HTTP -> HTTPS Redirects
    # ============================================
    server {
        listen 80;
        server_name eckardt-vault.duckdns.org;
        location /.well-known/acme-challenge/ {
            alias C:/nginx/html/.well-known/acme-challenge/;
        }
        location / {
            return 301 https://eckardt-vault.duckdns.org$request_uri;
        }
    }

    server {
        listen 80;
        server_name eckardt-cloud.duckdns.org;
        location /.well-known/acme-challenge/ {
            alias C:/nginx/html/.well-known/acme-challenge/;
        }
        location / {
            return 301 https://eckardt-cloud.duckdns.org$request_uri;
        }
    }

    server {
        listen 80;
        server_name eckardt-git.duckdns.org;
        location /.well-known/acme-challenge/ {
            alias C:/nginx/html/.well-known/acme-challenge/;
        }
        location / {
            return 301 https://eckardt-git.duckdns.org$request_uri;
        }
    }

    server {
        listen 80;
        server_name eckardt-monitoring.duckdns.org;
        location /.well-known/acme-challenge/ {
            alias C:/nginx/html/.well-known/acme-challenge/;
        }
        location / {
            return 301 https://eckardt-monitoring.duckdns.org$request_uri;
        }
    }

    # ============================================
    # eckardt-vault.duckdns.org - Main Services
    # ============================================
    server {
        listen 443 ssl;
        http2 on;
        server_name eckardt-vault.duckdns.org;

        ssl_certificate C:/nginx/ssl/eckardt-vault.duckdns.org-chain.pem;
        ssl_certificate_key C:/nginx/ssl/eckardt-vault.duckdns.org-key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_prefer_server_ciphers off;

        # Vaultwarden - Password Manager
        location /vault/ {
            limit_req zone=login burst=5 nodelay;
            proxy_pass http://10.0.0.2:8083/;
            proxy_ssl_verify off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # n8n - Workflow Automation
        location /n8n/ {
            limit_req zone=general burst=20 nodelay;
            proxy_pass http://10.0.0.2:5678/;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # API - FastAPI Backend
        location /api/ {
            limit_req zone=general burst=50 nodelay;
            proxy_pass http://10.0.0.2:8000/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Websites - Static Content (Default)
        location / {
            limit_req zone=general burst=20 nodelay;
            proxy_pass http://10.0.0.2:8082/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    # ============================================
    # eckardt-cloud.duckdns.org - Nextcloud
    # ============================================
    server {
        listen 443 ssl;
        http2 on;
        server_name eckardt-cloud.duckdns.org;

        ssl_certificate C:/nginx/ssl/eckardt-cloud.duckdns.org-chain.pem;
        ssl_certificate_key C:/nginx/ssl/eckardt-cloud.duckdns.org-key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_prefer_server_ciphers off;

        location / {
            limit_req zone=general burst=50 nodelay;
            proxy_pass http://10.0.0.2:8081/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # Nextcloud specific
            proxy_connect_timeout 300;
            proxy_send_timeout 300;
            proxy_read_timeout 300;
        }
    }

    # ============================================
    # eckardt-git.duckdns.org - Gitea
    # ============================================
    server {
        listen 443 ssl;
        http2 on;
        server_name eckardt-git.duckdns.org;

        ssl_certificate C:/nginx/ssl/eckardt-git.duckdns.org-chain.pem;
        ssl_certificate_key C:/nginx/ssl/eckardt-git.duckdns.org-key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_prefer_server_ciphers off;

        location / {
            limit_req zone=general burst=30 nodelay;
            proxy_pass http://10.0.0.2:3000/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            client_max_body_size 1G;
        }
    }

    # ============================================
    # eckardt-monitoring.duckdns.org - Netdata
    # ============================================
    server {
        listen 443 ssl;
        http2 on;
        server_name eckardt-monitoring.duckdns.org;

        ssl_certificate C:/nginx/ssl/eckardt-monitoring.duckdns.org-chain.pem;
        ssl_certificate_key C:/nginx/ssl/eckardt-monitoring.duckdns.org-key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
        ssl_prefer_server_ciphers off;

        # HTTP Basic Auth
        auth_basic "Netdata Monitoring";
        auth_basic_user_file C:/nginx/conf/.htpasswd;

        location / {
            limit_req zone=general burst=50 nodelay;
            proxy_pass http://10.0.0.2:19999/;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";

            # Netdata Dashboard braucht WebSocket
            proxy_read_timeout 86400;
        }
    }
}