# One certificate (live/musify.ikerdemo.cat) covers the five hostnames.
server {
    listen 80;
    listen [::]:80;
    server_name musify.ikerdemo.cat musifyapi.ikerdemo.cat
                musifystream.ikerdemo.cat auth.ikerdemo.cat s3.ikerdemo.cat;
    include /etc/nginx/snippets/acme-redirect.conf;
}

# Web player. Uploads are posted to its own form actions.
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name musify.ikerdemo.cat;
    client_max_body_size 1024m;

    # The OIDC callback answers with the session cookies (encrypted tokens),
    # bigger than the 4k default response-header buffer.
    proxy_buffer_size 32k;
    proxy_buffers 8 32k;
    proxy_busy_buffers_size 64k;
    large_client_header_buffers 4 16k;

    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
    include /etc/nginx/snippets/tls.conf;

    location / {
        set $upstream http://musify-web-player:3000;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name musifyapi.ikerdemo.cat;

    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
    include /etc/nginx/snippets/tls.conf;

    location / {
        set $upstream http://musify-api:5111;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
    }
}

# Audio bytes. Buffering off keeps range requests (seeking) responsive.
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name musifystream.ikerdemo.cat;

    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
    include /etc/nginx/snippets/tls.conf;

    location / {
        set $upstream http://musify-gateway:8081;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
        proxy_buffering off;
    }
}

# Zitadel, shared with the other projects (hence the generic hostname).
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name auth.ikerdemo.cat;

    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
    include /etc/nginx/snippets/tls.conf;

    # Login V2 UI, a separate container (see ../compose.yml).
    location /ui/v2/login {
        set $upstream http://infra-zitadel-login:3000;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
    }

    location / {
        set $upstream http://infra-zitadel:8080;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
    }
}

# SeaweedFS S3: presigned PUT/GET straight from the browser.
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name s3.ikerdemo.cat;
    client_max_body_size 1024m;

    ssl_certificate     /etc/letsencrypt/live/musify.ikerdemo.cat/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/musify.ikerdemo.cat/privkey.pem;
    include /etc/nginx/snippets/tls.conf;

    location / {
        set $upstream http://infra-seaweedfs:8333;
        proxy_pass $upstream;
        include /etc/nginx/snippets/proxy.conf;
        proxy_request_buffering off;
    }
}