# WebSocket support
map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

# Redirect HTTP -> HTTPS
server {
    listen 80;
    server_name
        cloud.someoneslinux.selfhost.eu
        media.someoneslinux.selfhost.eu
        audiobooks.someoneslinux.selfhost.eu
        login.someoneslinux.selfhost.eu
        auto.someoneslinux.selfhost.eu
        music.someoneslinux.selfhost.eu
        passwd.someoneslinux.selfhost.eu
        requests.someoneslinux.selfhost.eu
        torrent.someoneslinux.selfhost.eu
        status.someoneslinux.selfhost.eu    
        code.someoneslinux.selfhost.eu;    
    #ssl_conf_command Groups X25519:secp256r1:secp384r1;
#    ssl_conf_command Groups X25519:prime256v1:secp384r1;
    location /.well-known/acme-challenge/ {
        root /usr/share/nginx/html;
        try_files $uri =404;
    }

    location / {
        return 301 https://$host$request_uri;

    }

    listen 8080;
    location /nginx_status {
        stub_status;
        allow 172.16.0.0/12;
        deny all;
    }
}

# Common SSL settings
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
server {
    listen 443 ssl default_server;
    server_name _;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
    return 404;
}

###################
# NEXTCLOUD
###################
server {
    listen 443 ssl;http2 on;
    server_name cloud.someoneslinux.selfhost.eu;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 
    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    client_max_body_size 10G;

    location / {
        proxy_pass http://nextcloud:80;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

###################
# JELLYFIN
###################
server {
    listen 443 ssl;http2 on;
    server_name media.someoneslinux.selfhost.eu;

    add_header Content-Security-Policy "frame-ancestors 'self';" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://jellyfin:8096;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

###################
# AUDIOBOOKSHELF
###################
server {
    listen 443 ssl;http2 on;
    server_name audiobooks.someoneslinux.selfhost.eu;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://audiobookshelf:80;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-Proto https;
    }
}

####################
## AUTHENTIK
####################
#server {
#    listen 443 ssl;http2 on;
#    server_name login.someoneslinux.selfhost.eu;
#
#    add_header Content-Security-Policy "frame-ancestors 'self';" always;
#    add_header X-Frame-Options "SAMEORIGIN" always;
#    add_header X-Content-Type-Options "nosniff" always;
#    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
#    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
#
#    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
#    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;
#
#    location / {
#        proxy_pass http://authentik-server-1:9000;
#        proxy_http_version 1.1;
#        
#        proxy_set_header X-Forwarded-Proto https;
#        proxy_set_header X-Forwarded-Host $host;
#        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#    }
#}

###################
# HOME ASSISTANT
###################
server {
    listen 443 ssl;http2 on;
    server_name auto.someoneslinux.selfhost.eu;

#    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://192.168.0.4:8123;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

###################
# NAVIDROME
###################
server {
    listen 443 ssl;http2 on;
    server_name music.someoneslinux.selfhost.eu;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://navidrome:4533;

        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

###################
# VAULTWARDEN
###################
server {
    listen 443 ssl;http2 on;
    server_name passwd.someoneslinux.selfhost.eu;

    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://vaultwarden:80;
        # Do not try another upstream on errors
        proxy_next_upstream off;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /notifications/hub {
        proxy_pass http://vaultwarden:3012;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

###################
# SEERR
###################
server {
    listen 443 ssl;http2 on;
    server_name requests.someoneslinux.selfhost.eu;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://seerr:5055;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-Proto https;
    }
}

###################
# QBITTORRENT
###################
server {
    listen 443 ssl;http2 on;
    server_name torrent.someoneslinux.selfhost.eu;

    add_header Content-Security-Policy "frame-ancestors 'self';" always;
#    add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self';" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://192.168.0.2:8080;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;
 
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-Proto https;
    }

}

###################
# GRFANA
###################
server {
    listen 443 ssl;http2 on;
    server_name status.someoneslinux.selfhost.eu;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://grafana:3000;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header X-Forwarded-Proto https;
    }
}

###################
# GITEA
###################
server {
    listen 443 ssl;http2 on;
    server_name code.someoneslinux.selfhost.eu;

    add_header Content-Security-Policy "frame-ancestors 'self';" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    ssl_certificate /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/live/cloud.someoneslinux.selfhost.eu/privkey.pem;

    location / {
        proxy_pass http://gitea:3000;
        # Do not try another upstream on errors
        proxy_next_upstream off;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}