events { worker_connections 1024; }

http {

    upstream nexus_http         { server nexus:8081; }
    upstream nexus_docker       { server nexus:5000; }
    upstream nexus_ghcr         { server nexus:5001; }
    upstream nexus_docker_group { server nexus:8082; }
    upstream nexus_docker_host  { server nexus:8083; }

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
    }

    proxy_read_timeout    300s;
    proxy_connect_timeout  60s;
    proxy_send_timeout    300s;
    client_max_body_size  1g;

    # =========================================================
    # Nexus UI — nexus.soroushasadi.com
    # =========================================================
    server {
        listen 80;
        server_name nexus.soroushasadi.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name nexus.soroushasadi.com;
        client_max_body_size 1g;

        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;

        location / {
            proxy_pass http://nexus_http;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    # =========================================================
    # Docker registry — mirror.soroushasadi.com
    # =========================================================
    server {
        listen 80;
        server_name mirror.soroushasadi.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name mirror.soroushasadi.com;

        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;

        client_max_body_size 0;
        proxy_read_timeout   3600s;
        proxy_send_timeout   3600s;
        proxy_request_buffering off;

        location /v2/token {
            proxy_pass         http://nexus_docker_group;
            proxy_set_header   Host              $http_host;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto https;
            proxy_buffering    off;
        }

        location /v2/docker-host/ {
            proxy_pass         http://nexus_docker_host;
            proxy_set_header   Host              $http_host;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto https;
            proxy_buffering    off;
            proxy_hide_header  WWW-Authenticate;
            add_header         WWW-Authenticate "Bearer realm=\"https://mirror.soroushasadi.com/v2/token\",service=\"mirror.soroushasadi.com\"" always;
        }

        location /v2/ {
            proxy_pass         http://nexus_docker_group;
            proxy_set_header   Host              $http_host;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto https;
            proxy_buffering    off;
            proxy_hide_header  WWW-Authenticate;
            add_header         WWW-Authenticate "Bearer realm=\"https://mirror.soroushasadi.com/v2/token\",service=\"mirror.soroushasadi.com\"" always;
        }

        location / {
            proxy_pass         http://nexus_http;
            proxy_set_header   Host              $http_host;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto https;
        }
    }

    # =========================================================
    # Gitea — git.soroushasadi.com
    # =========================================================
    server {
        listen 80;
        server_name git.soroushasadi.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name git.soroushasadi.com;
        client_max_body_size 300m;

        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:3000;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    # =========================================================
    # Docker Hub proxy (port 5000) — legacy
    # =========================================================
    server {
        listen 5000;
        server_name _;
        location / {
            proxy_pass http://nexus_docker;
            proxy_set_header Host              $http_host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_buffering off;
        }
    }

    # =========================================================
    # GHCR proxy (port 5001) — legacy
    # =========================================================
    server {
        listen 5001;
        server_name _;
        location / {
            proxy_pass http://nexus_ghcr;
            proxy_set_header Host              $http_host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_buffering off;
        }
    }

    # =========================================================
    # DrAletaha — draletaha.ir
    # =========================================================
    server {
        listen 80;
        server_name draletaha.ir;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name draletaha.ir;
        client_max_body_size 25m;

        ssl_certificate     /etc/ssl/draletaha/fullchain.pem;
        ssl_certificate_key /etc/ssl/draletaha/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:5010;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        $connection_upgrade;
        }
    }

    # =========================================================
    # Meezi
    # =========================================================
    server {
        listen 80;
        server_name meezi.ir app.meezi.ir admin.meezi.ir koja.meezi.ir api.meezi.ir admin-api.meezi.ir;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name meezi.ir;
        client_max_body_size 25m;

        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:3010;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        $connection_upgrade;
        }
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name app.meezi.ir;
        client_max_body_size 25m;

        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:3101;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        $connection_upgrade;
        }
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name admin.meezi.ir;
        client_max_body_size 25m;

        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:3102;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        $connection_upgrade;
        }
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name koja.meezi.ir;
        client_max_body_size 25m;

        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:3103;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        $connection_upgrade;
        }
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name api.meezi.ir;
        client_max_body_size 50m;

        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:5080;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        $connection_upgrade;
            proxy_read_timeout 3600s;
        }
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name admin-api.meezi.ir;
        client_max_body_size 50m;

        ssl_certificate     /etc/ssl/meezi/fullchain.pem;
        ssl_certificate_key /etc/ssl/meezi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:5081;
            proxy_http_version 1.1;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Upgrade           $http_upgrade;
            proxy_set_header Connection        $connection_upgrade;
            proxy_read_timeout 3600s;
        }
    }

    # =========================================================
    # Soroush personal site — soroushasadi.com
    # =========================================================
    server {
        listen 80;
        server_name soroushasadi.com www.soroushasadi.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name soroushasadi.com www.soroushasadi.com;
        client_max_body_size 25m;

        ssl_certificate     /etc/ssl/soroushasadi/fullchain.pem;
        ssl_certificate_key /etc/ssl/soroushasadi/privateKey.pem;

        location / {
            proxy_pass http://171.22.25.73:3020;
            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    # =========================================================
    # AbzarAsadi — abzarasadi.ir  →  :4310
    # =========================================================
    server {
        listen 80;
        server_name abzarasadi.ir www.abzarasadi.ir;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        http2 on;
        server_name abzarasadi.ir www.abzarasadi.ir;
        client_max_body_size 25m;

        ssl_certificate     /etc/ssl/abzarasadi/fullchain.pem;
        ssl_certificate_key /etc/ssl/abzarasadi/privateKey.pem;

        location / {
            proxy_pass         http://171.22.25.73:4310;
            proxy_http_version 1.1;
            proxy_set_header   Host              $host;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   Upgrade           $http_upgrade;
            proxy_set_header   Connection        $connection_upgrade;
        }
    }

}