# apps.f0xx.org — Android Cast public vhost (FE Gentoo).
# Included from nginx.conf:  include /etc/nginx/apps.conf;
#
# Upstream: BE nginx on artc0.intra.raptor.org:80 (hub PHP, crashes, graphs, build, OTA).
# Git browser: BE :3000 (Gitea).  Do not proxy androidcast to BE :443 or :8089.
#
# Reload:  nginx -t && rc-service nginx reload

server {
	listen 80;
	server_name apps.f0xx.org;
	return 301 https://$host$request_uri;
}

server {
	listen 443 ssl http2;
	server_name apps.f0xx.org;

	access_log /var/log/nginx/apps.intra.raptor.org.access_log main;
	error_log /var/log/nginx/apps.intra.raptor.org.error_log info;

	ssl_certificate /etc/letsencrypt/live/apps.f0xx.org/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/apps.f0xx.org/privkey.pem;

	# --- OTA artifacts (BE static tree on listen 80) ---
	location ^~ /v0/ota/ {
		proxy_pass http://artc0.intra.raptor.org:80;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# --- APK builder (long-running Docker builds) ---
	location = /app/androidcast_project/build {
		return 301 $scheme://$host/app/androidcast_project/build/;
	}
	location ^~ /app/androidcast_project/build/ {
		proxy_pass http://artc0.intra.raptor.org:80;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Host $host;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
		proxy_read_timeout 1800s;
		proxy_send_timeout 1800s;
		client_max_body_size 512m;
	}

	# --- Crash / ticket console ---
	location = /app/androidcast_project/crashes {
		return 301 $scheme://$host/app/androidcast_project/crashes/;
	}
	location ^~ /app/androidcast_project/crashes/ {
		proxy_pass http://artc0.intra.raptor.org:80;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		client_max_body_size 16m;
	}

	# --- Graphs dashboard ---
	location = /app/androidcast_project/graphs {
		return 301 $scheme://$host/app/androidcast_project/graphs/;
	}
	location ^~ /app/androidcast_project/graphs/ {
		proxy_pass http://artc0.intra.raptor.org:80;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# --- Hub landing (PHP index) ---
	location = /app/androidcast_project {
		return 301 $scheme://$host/app/androidcast_project/;
	}
	location ^~ /app/androidcast_project/ {
		proxy_pass http://artc0.intra.raptor.org:80;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
	}

	# --- Gitea web UI ---
	location = /app/androidcast_project/git {
		return 301 $scheme://$host/app/androidcast_project/git/;
	}
	location ^~ /app/androidcast_project/git/ {
		proxy_pass http://artc0.intra.raptor.org:3000/;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Host $host;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
		proxy_read_timeout 1800s;
		proxy_send_timeout 1800s;
		client_max_body_size 512m;
	}

	# --- Default: anything else on this vhost → BE :80 ---
	location / {
		proxy_pass http://artc0.intra.raptor.org:80;
		proxy_http_version 1.1;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_connect_timeout 120s;
		proxy_send_timeout 120s;
		proxy_read_timeout 180s;
		proxy_buffers 16 16m;
		proxy_buffer_size 16m;
		client_body_buffer_size 16m;
		client_max_body_size 16m;
		proxy_buffering off;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
		proxy_cache_bypass $http_upgrade;
	}

	location ~ /\.ht {
		deny all;
	}
}
