# server {
#     listen 443 ssl http2  ;  

#     server_name guaranteedstruggle.host;
#     return 302 https://dashy.guaranteedstruggle.host;  
#     # ssl_certificate /etc/angie/ssl/guaranteedstruggle.host/cert.pem;
#     # ssl_certificate_key /etc/angie/ssl/guaranteedstruggle.host/key.pem;

#     ssl_certificate /etc/angie/ssl/dashy.guaranteedstruggle.host/cert.pem;
#     ssl_certificate_key /etc/angie/ssl/dashy.guaranteedstruggle.host/key.pem;
# }
 
  
  



server {
    listen 443 ssl http2;

    server_name wikijs.guaranteedstruggle.host;

    location / { 
      proxy_pass http://192.168.0.143:3000/;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
    ssl_certificate /etc/angie/ssl/wikijs.guaranteedstruggle.host/cert.pem;
    ssl_certificate_key /etc/angie/ssl/wikijs.guaranteedstruggle.host/key.pem;


    # для огромных таблиц линк громадный
    # https://stackoverflow.com/questions/1067334/how-to-set-the-allowed-url-length-for-a-nginx-request-error-code-414-uri-too
    client_max_body_size 124M;
    client_body_buffer_size 2M;

    client_header_buffer_size 15120k;
    large_client_header_buffers 16 15120k;
}
server {
    listen 443 ssl http2;

    server_name keycloak.guaranteedstruggle.host;

    location / { 
      proxy_pass http://192.168.0.231:8080;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }
    ssl_certificate /etc/angie/ssl/keycloak.guaranteedstruggle.host/cert.pem;
    ssl_certificate_key /etc/angie/ssl/keycloak.guaranteedstruggle.host/key.pem;
}

upstream netbird_dashboard {
    server 192.168.0.39:8080;
    keepalive 10;
}
upstream netbird_server {
    server 192.168.0.39:8081;
}

server {
    listen 80;
    server_name noir-films.guaranteedstruggle.host;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name noir-films.guaranteedstruggle.host;
    http2 on;
    ssl_certificate /etc/angie/ssl/noir-films.guaranteedstruggle.host/cert.pem;
    ssl_certificate_key /etc/angie/ssl/noir-films.guaranteedstruggle.host/key.pem;

    # Recommended SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

    # Required for long-lived gRPC connections
    client_header_timeout 1d;
    client_body_timeout 1d;

    # Common proxy headers
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-Host $host;
    grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    # WebSocket connections (relay, signal, management)
    location ~ ^/(relay|ws-proxy/) {
        proxy_pass http://netbird_server;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_read_timeout 1d;
    }

    # Native gRPC (signal + management)
    location ~ ^/(signalexchange\.SignalExchange|management\.ManagementService)/ {
        grpc_pass grpc://netbird_server;
        grpc_read_timeout 1d;
        grpc_send_timeout 1d;
        grpc_socket_keepalive on;
    }

    # HTTP routes (API + OAuth2)
    location ~ ^/(api|oauth2)/ {
        proxy_pass http://netbird_server;
        proxy_set_header Host $host;
    }

    # Dashboard (catch-all)
    location / {
        proxy_pass http://netbird_dashboard;
    }
}


# For WebSocket
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
} 
proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache1:16m max_size=1g inactive=720m use_temp_path=off;
server {
    listen 443 ssl;
    http2 on;
    server_name valavala.ru; 

    ssl_session_timeout 1d;
    ssl_session_cache shared:ssl_session_cache:10m;
    ssl_session_tickets off;

    # SSL protocol settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    #####ssl_stapling on;
    ####ssl_stapling_verify on;


    location / { 
      proxy_pass http://192.168.0.55:3033/;

      proxy_set_header Host $host;
      proxy_http_version 1.1;
      proxy_redirect off;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      # For WebSocket
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;

      # Cache settings
      proxy_cache cache1;
      proxy_cache_lock on;
      proxy_cache_use_stale updating;
      proxy_force_ranges on;
      add_header X-Cache $upstream_cache_status;
    }
    ssl_certificate /etc/angie/ssl/valavala.ru/cert.pem;
    ssl_certificate_key /etc/angie/ssl/valavala.ru/key.pem;
}
 

server {
    listen 443 ssl http2;
    listen 8448 ssl http2;

    server_name matrix-server.guaranteedstruggle.host;

    location / { 
      proxy_pass http://192.168.0.180:8008/;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";


      # Установите лимит, соответствующий или превышающий Tuwunel
      client_max_body_size 50M; 
      
      # Для больших файлов также полезно увеличить тайм-ауты
      proxy_read_timeout 300s;
      proxy_connect_timeout 300s;
      proxy_send_timeout 300s;
    }
    ssl_certificate /etc/angie/ssl/matrix-server.guaranteedstruggle.host/cert.pem;
    ssl_certificate_key /etc/angie/ssl/matrix-server.guaranteedstruggle.host/key.pem;
}


server {
    listen 443 ssl http2;

    server_name git.guaranteedstruggle.host;
    ssl_certificate /etc/angie/ssl/git.guaranteedstruggle.host/cert.pem;
    ssl_certificate_key /etc/angie/ssl/git.guaranteedstruggle.host/key.pem;



    location / {
      # proxy_pass http://localhost:3000;
      proxy_pass http://192.168.0.33:3000;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    }

}

 
server {
    listen 443 ssl ; # http2;

    server_name mail.guaranteedstruggle.host imap.guaranteedstruggle.host pop3.guaranteedstruggle.host;
    #ssl_certificate /etc/angie/ssl/mail.guaranteedstruggle.host/cert.pem;
   # ssl_certificate_key /etc/angie/ssl/mail.guaranteedstruggle.host/key.pem;
 
    location / {
      #proxy_pass http://localhost:8880;
      ####proxy_pass http://192.168.0.251:8080;
      proxy_pass https://mail.guaranteedstruggle.host;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    } 
} 





 


# # # # Map server names to a composite string containing certificate file, key file, and proxy pass URL
# # # map $http_host $host_config {
# # #     nihil-unbound.guaranteedstruggle.host "/etc/angie/ssl/nihil-unbound.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/nihil-unbound.guaranteedstruggle.host/privkey.pem:http://default_backend";
# # #     blog.guaranteedstruggle.host          "/etc/angie/ssl/blog.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/blog.guaranteedstruggle.host/privkey.pem:http://default_backend";
# # #     mail.guaranteedstruggle.host          "/etc/angie/ssl/mail.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/mail.guaranteedstruggle.host/privkey.pem:http://default_backend";
# # #     pgadmin.guaranteedstruggle.host       "/etc/angie/ssl/pgadmin.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/pgadmin.guaranteedstruggle.host/privkey.pem:http://pgadmin_on_swarm_cluster";
# # #     ceph-dashboard.guaranteedstruggle.host "/etc/angie/ssl/ceph-dashboard.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/ceph-dashboard.guaranteedstruggle.host/privkey.pem:http://192.168.0.71:8080";
# # #     k3s-rancher.guaranteedstruggle.host     "/etc/angie/ssl/k3s-rancher.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/k3s-rancher.guaranteedstruggle.host/privkey.pem:https://192.168.0.30";
# # #     wiki.guaranteedstruggle.host          "/etc/angie/ssl/wiki.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/wiki.guaranteedstruggle.host/privkey.pem:http://wikijs_on_swarm_cluster";
# # #    # portainer.guaranteedstruggle.host       "/etc/angie/ssl/portainer.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/portainer.guaranteedstruggle.host/privkey.pem:https://swarm-node1.guaranteedstruggle.host:9443";
# # #     kroki.guaranteedstruggle.host           "/etc/angie/ssl/kroki.guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/kroki.guaranteedstruggle.host/privkey.pem:http://swarm-node1.guaranteedstruggle.host:8008";
# # #     guaranteedstruggle.host               "/etc/angie/ssl/guaranteedstruggle.host/fullchain.pem:/etc/angie/ssl/guaranteedstruggle.host/privkey.pem:http://192.168.0.105";
# # #     default                             "/etc/angie/ssl/default/fullchain.pem:/etc/angie/ssl/default/privkey.pem:http://default_backend";
# # # }


# # # # Extract SSL certificate file
# # # map $http_host $ssl_certificate_file {
# # #     kroki.guaranteedstruggle.host         "/etc/angie/ssl/asdf/fullchain.pem"
# # #     default                               "/etc/angie/ssl/$http_host/fullchain.pem"
# # # }


# # # # Extract SSL certificate file
# # # map $host_config $ssl_certificate_file {
# # #     "~^(?<certificate_file>[^:]+):"      "$certificate_file";
# # #     default                               "/etc/angie/ssl/default/fullchain.pem";
# # # }

# # # # Extract SSL certificate key file
# # # map $host_config $ssl_certificate_key_file {
# # #     "~:[^:]+:(?<key_file>[^:]+)$"       "$key_file";
# # #     default                               "/etc/angie/ssl/default/privkey.pem";
# # # }

# # # # Extract proxy pass URL
# # # map $host_config $proxy_pass_url {
# # #     "~:[^:]+:[^:]+:(?<proxy_url>.*)$"  "$proxy_url";
# # #     default                               "http://default_backend";
# # # }
 

# server {
#     listen 443 ssl http2;

#     server_name harbor.guaranteedstruggle.host;
#     ssl_certificate /etc/angie/ssl/harbor.guaranteedstruggle.host/cert.pem;
#     ssl_certificate_key /etc/angie/ssl/harbor.guaranteedstruggle.host/key.pem;
     

#     location / {
#       proxy_pass http://localhost:8880;

#       proxy_set_header Host $host;
#       proxy_set_header X-Real-IP $remote_addr;
#       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#       proxy_set_header X-Forwarded-Proto $scheme;
#     } 
# }

  

 

server {
    listen 80; # http2;

    server_name mail.guaranteedstruggle.host imap.guaranteedstruggle.host pop3.guaranteedstruggle.host;
    #ssl_certificate /etc/angie/ssl/mail.guaranteedstruggle.host/cert.pem;
   # ssl_certificate_key /etc/angie/ssl/mail.guaranteedstruggle.host/key.pem;
 
    location / {
      #proxy_pass http://localhost:8880;
      ####proxy_pass http://192.168.0.251:8080;
      proxy_pass http://192.168.0.251:8080;

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
    } 
} 
server {
      listen 80 default_server; 
      #default_server;
        #listen [::]:80 default_server;

       server_name _;
       return 302 https://$host$request_uri;

}


server {
    listen       8080;
    server_name  localhost;
    #access_log  /var/log/angie/host.access.log  main;

    location / {
        root   /usr/share/angie/html;
        index  index.html index.htm;
    }

    location /status/ {
        api     /status/;
        allow   all;
        deny    all;
    }


    location /console/ {

      allow all;
      deny all;

      auto_redirect on;

      alias /usr/share/angie-console-light/html/;
      index index.html;


      location /console/api/ {
          api /status/;
      }

      location /console/api/config/ {
        #auth_basic           ;
        #auth_basic_user_file conf/htpasswd;
        api /config/;
      }
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/angie/html;
    }

}