# ============================================================
# example.com - Main landing page (HTTP only, no cert for bare domain)
# ============================================================
server {
    listen 80;
    server_name example.com;

    root /var/www/example.com;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

# ============================================================
# web.example.com - HTTPS landing page
# ============================================================
server {
    listen 443 ssl;
    server_name web.example.com www.web.example.com;

    ssl_certificate     /etc/ssl/certs/web.example.com.pem;
    ssl_certificate_key /etc/ssl/private/web.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    root /var/www/example.com;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

# HTTP -> HTTPS redirect for web.example.com
server {
    listen 80;
    server_name web.example.com www.web.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# tv.example.com - Jellyfin
# ============================================================
server {
    listen 443 ssl;
    server_name tv.example.com;

    ssl_certificate     /etc/ssl/certs/tv.example.com.pem;
    ssl_certificate_key /etc/ssl/private/tv.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:8096;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name tv.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# ai.example.com - Open WebUI
# ============================================================
server {
    listen 443 ssl;
    server_name ai.example.com;

    ssl_certificate     /etc/ssl/certs/ai.example.com.pem;
    ssl_certificate_key /etc/ssl/private/ai.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_buffering    off;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        client_max_body_size 20m;
        gzip off;
    }
}

server {
    listen 80;
    server_name ai.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# agents.example.com - n8n
# ============================================================
server {
    listen 443 ssl;
    server_name agents.example.com;

    ssl_certificate     /etc/ssl/certs/agents.example.com.pem;
    ssl_certificate_key /etc/ssl/private/agents.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:5678;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
        gzip off;
    }
}

server {
    listen 80;
    server_name agents.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# papers.example.com - Arxiv Sanity Lite
# ============================================================
server {
    listen 443 ssl;
    server_name papers.example.com;

    ssl_certificate     /etc/ssl/certs/papers.example.com.pem;
    ssl_certificate_key /etc/ssl/private/papers.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:7800;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name papers.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# pin.example.com - Karakeep
# ============================================================
server {
    listen 443 ssl;
    server_name pin.example.com;

    ssl_certificate     /etc/ssl/certs/pin.example.com.pem;
    ssl_certificate_key /etc/ssl/private/pin.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:4444;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name pin.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# clip.example.com - Jelly Clip
# ============================================================
server {
    listen 443 ssl;
    server_name clip.example.com;

    ssl_certificate     /etc/ssl/certs/clip.example.com.pem;
    ssl_certificate_key /etc/ssl/private/clip.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:5001;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name clip.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# paste.example.com - Pastebin
# ============================================================
server {
    listen 443 ssl;
    server_name paste.example.com;

    ssl_certificate     /etc/ssl/certs/paste.example.com.pem;
    ssl_certificate_key /etc/ssl/private/paste.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:9780;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name paste.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# llm.example.com - LiteLLM Proxy
# ============================================================
server {
    listen 443 ssl;
    server_name llm.example.com;

    ssl_certificate     /etc/ssl/certs/llm.example.com.pem;
    ssl_certificate_key /etc/ssl/private/llm.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:4000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name llm.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# monitor.example.com - Grafana
# ============================================================
server {
    listen 443 ssl;
    server_name monitor.example.com;

    ssl_certificate     /etc/ssl/certs/monitor.example.com.pem;
    ssl_certificate_key /etc/ssl/private/monitor.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:3003;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name monitor.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# stocks.example.com - Stock Docs Article Server
# ============================================================
server {
    listen 443 ssl;
    server_name stocks.example.com;

    ssl_certificate     /etc/ssl/certs/stocks.example.com.pem;
    ssl_certificate_key /etc/ssl/private/stocks.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:5008;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name stocks.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# stockmcp.example.com - Stock MCP
# ============================================================
server {
    listen 443 ssl;
    server_name stockmcp.example.com;

    ssl_certificate     /etc/ssl/certs/stockmcp.example.com.pem;
    ssl_certificate_key /etc/ssl/private/stockmcp.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        proxy_pass         http://localhost:5005;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name stockmcp.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# play.example.com - (placeholder - specify backend port)
# ============================================================
server {
    listen 443 ssl;
    server_name play.example.com;

    ssl_certificate     /etc/ssl/certs/play.example.com.pem;
    ssl_certificate_key /etc/ssl/private/play.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    location / {
        return 503 "Service not configured - set backend port";
    }
}

server {
    listen 80;
    server_name play.example.com;
    return 301 https://$host$request_uri;
}

# ============================================================
# git.example.com - Gitea (HTTPS)
# ============================================================
server {
    listen 443 ssl;
    server_name git.example.com;

    ssl_certificate     /etc/ssl/certs/git.example.com.pem;
    ssl_certificate_key /etc/ssl/private/git.example.com.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    client_max_body_size 50M;

    location / {
        proxy_pass         http://192.168.8.192:3000;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

server {
    listen 80;
    server_name git.example.com;
    return 301 https://$host$request_uri;
}

# books.example.com - Bookworm
server {
    listen 80;
    server_name books.example.com;

    location / {
        proxy_pass         http://localhost:1333;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# ai-host.example.com - Ollama
server {
    listen 80;
    server_name ai-host.example.com;

    location / {
        proxy_pass         http://192.168.8.124:11434;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# chat.example.com - Element/Matrix UI
server {
    listen 80;
    server_name chat.example.com;

    location / {
        proxy_pass         http://localhost:8009;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# conduit.example.com - Matrix Server
server {
    listen 80;
    server_name conduit.example.com;

    location / {
        proxy_pass         http://localhost:8448;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# tiktok.example.com
server {
    listen 80;
    server_name tiktok.example.com;

    location / {
        proxy_pass         http://0.0.0.0:4321;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# archive.example.com - ArchiveBox
server {
    listen 80;
    server_name archive.example.com;

    location / {
        proxy_pass         http://localhost:1234;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# loop.example.com - Karakeep Chrome extension
server {
    listen 80;
    server_name loop.example.com;

    location / {
        proxy_pass         http://localhost:3010;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# board.example.com - Karakeep board
server {
    listen 80;
    server_name board.example.com;

    location / {
        proxy_pass         http://localhost:3001;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# substack.example.com - Static Substack pages
server {
    listen 80;
    listen [::]:80;
    server_name substack.example.com;

    root /mnt/centralstoragemedia/Websites/Substack/substack_html_pages;
    index index.html;

    location /substack_html_pages/ {
        alias /mnt/centralstoragemedia/Websites/Substack/substack_html_pages/;
        try_files $uri $uri/ =404;
    }

    location /economics/ {
       alias /mnt/centralstoragemedia/Websites/Substack/substack_html_pages/paulkrugman/;
       try_files $uri $uri/ =404;
    }

    server_tokens off;
    autoindex off;

    location = /ai {
        rewrite ^ /natesnewsletter.html break;
    }

    location = /economics {
        rewrite ^ /paulkrugman.html break;
    }

    location = /games {
        rewrite ^ /theshortcut.html break;
    }

    error_page 404 /404.html;
    location = /404.html {
        internal;
        root /etc/nginx/html;
    }

    location ^~ /assets/js/ {
        alias /mnt/centralstoragemedia/Websites/Substack/assets/js/;
        default_type application/javascript;
        expires 30d;
    }

    location ^~ /assets/css/ {
        alias /mnt/centralstoragemedia/Websites/Substack/assets/css/;
        default_type text/css;
        expires 30d;
    }

    access_log /var/log/nginx/substack.access.log;
    error_log  /var/log/nginx/substack.error.log;
}

# kiwix.example.com - Wikipedia/Kiwix
server {
    listen 80;
    server_name kiwix.example.com;

    location / {
        proxy_pass          http://127.0.0.1:8008;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# archive2.example.com - ArchiveBox snapshots
server {
    listen 80;
    listen [::]:80;
    server_name archive2.example.com;

    root /mnt/centralstoragemedia/Websites/ArchiveBox/data/archive;
    index singlefile.html;

    location / {
        try_files $uri/singlefile.html $uri/index.html $uri/output.pdf =404;
    }

    location ~ ^/([^/]+)/pdf$ {
        try_files $uri /$1/output.pdf =404;
    }

    location ~ ^/([^/]+)/html$ {
        try_files $uri /$1/output.html =404;
    }

    location ~ ^/([^/]+)/singlefile$ {
        try_files $uri /$1/singlefile.html =404;
    }

    server_tokens off;
    autoindex off;

    error_page 404 /404.html;
    location = /404.html {
        internal;
        root /etc/nginx/html;
    }

    access_log /var/log/nginx/archive2.access.log;
    error_log  /var/log/nginx/archive2.error.log;
}

# red.example.com - Reddit
server {
    listen 80;
    server_name red.example.com;

    location / {
        proxy_pass         http://localhost:6006;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# space.example.com - NASA
server {
    listen 80;
    server_name space.example.com;

    location / {
        proxy_pass         http://localhost:6008;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# insights.example.com
server {
    listen 80;
    server_name insights.example.com;

    location / {
        proxy_pass         http://localhost:5010;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
    }
}

# podcast.example.com - Static podcast files
server {
    listen 80;
    server_name podcast.example.com;

    root /mnt/centralstoragemedia/Podcasts;

    location / {
        try_files $uri.wav =404;
    }

    location ~* \.wav$ {
        try_files $uri =404;
    }
}