map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# ── Main app: friessn.de ────────────────────────────────────────────────────
server {
    listen 80;
    server_name {{ domain }};
    # certbot --nginx adds SSL redirect + listen 443 block here

    root /var/www/html;
    index index.html;

    location = / {
        try_files /index.html =404;
    }

    location = /api { return 301 /api/; }
    location /api/ {
        rewrite ^/api/(.*) /$1 break;
        proxy_pass         http://127.0.0.1:8000;
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }

    location = /beekeeper { return 301 /beekeeper/; }
    location /beekeeper/ {
        rewrite ^/beekeeper/(.*) /$1 break;
        proxy_pass         http://127.0.0.1:3838;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        $connection_upgrade;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }

    location = /listkeeper { return 301 /listkeeper/; }
    location /listkeeper/ {
        rewrite ^/listkeeper/(.*) /$1 break;
        proxy_pass         http://127.0.0.1:3839;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        $connection_upgrade;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
}

# ── Gitea: git.friessn.de ───────────────────────────────────────────────────
server {
    listen 80;
    server_name {{ gitea_domain }};
    # certbot --nginx adds SSL redirect + listen 443 block here

    client_max_body_size 512m;

    location / {
        proxy_pass         http://127.0.0.1:{{ gitea_http_port }};
        proxy_http_version 1.1;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}