# ============================================================================
# hamkadr.ir  — paste these two server{} blocks INTO the http { } block of your
# central nginx.conf (the one with nexus/mirror/gitea/meezi), then:
#   nginx -t && nginx -s reload      (or: docker exec <nginx> nginx -s reload)
#
# Prereqs (match your existing pattern):
#   • TLS cert placed at /etc/ssl/hamkadr/fullchain.pem + privateKey.pem  (manual, like your others)
#   • hamkadr.ir + www.hamkadr.ir  A records → 171.22.25.73
#   • the app published on the host at :2569 (docker-compose.yml) — nginx reaches it via the host IP,
#     exactly like meezi (5080), draletaha (5010), etc.  $connection_upgrade map is already defined globally.
# ============================================================================

server {
    listen 80;
    server_name hamkadr.ir www.hamkadr.ir;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name hamkadr.ir www.hamkadr.ir;
    client_max_body_size 25m;

    ssl_certificate     /etc/ssl/hamkadr/fullchain.pem;
    ssl_certificate_key /etc/ssl/hamkadr/privateKey.pem;

    location / {
        proxy_pass http://171.22.25.73:2569;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;   # app's ForwardedHeaders reads this → knows it's HTTPS
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        $connection_upgrade;
    }
}