# ─────────────────────────────────────────────────────────────
#  Greendale Media Centre — Nginx Reverse Proxy Config
#  SUBDOMAIN variant:  https://media.yourdomain.com
#
#  1. Copy this file to /etc/nginx/conf.d/ (or your Nginx proxy
#     manager's custom config directory) on your Unraid server.
#  2. Replace "media.yourdomain.com" with your actual domain.
#  3. Replace "YOUR_UNRAID_IP" with your Unraid server's LAN IP.
#  4. Replace "5055" if you changed HOST_PORT in .env.
#  5. SSL is handled by Nginx Proxy Manager (recommended on Unraid)
#     — point it at this container on port 5055.
# ─────────────────────────────────────────────────────────────

server {
    listen 80;
    server_name media.yourdomain.com;

    # Redirect all HTTP → HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name media.yourdomain.com;

    # ── SSL certificates (managed by NPM or Certbot) ──
    # ssl_certificate     /etc/letsencrypt/live/media.yourdomain.com/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/media.yourdomain.com/privkey.pem;

    # ── Security headers ──
    add_header X-Frame-Options          "SAMEORIGIN"           always;
    add_header X-Content-Type-Options   "nosniff"              always;
    add_header X-XSS-Protection         "1; mode=block"        always;
    add_header Referrer-Policy          "strict-origin"        always;
    add_header Strict-Transport-Security "max-age=31536000"    always;

    # ── Proxy to Flask container ──
    location / {
        proxy_pass         http://YOUR_UNRAID_IP:5055;
        proxy_http_version 1.1;

        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;

        # WebSocket support (future-proof)
        proxy_set_header   Upgrade           $http_upgrade;
        proxy_set_header   Connection        "upgrade";

        proxy_read_timeout  90;
        proxy_connect_timeout 90;
        proxy_send_timeout  90;

        # Buffer settings for smooth streaming
        proxy_buffering    on;
        proxy_buffer_size  8k;
        proxy_buffers      8 8k;
    }

    # ── Static asset caching ──
    location ~* \.(css|js|png|jpg|ico|woff2?)$ {
        proxy_pass         http://YOUR_UNRAID_IP:5055;
        proxy_set_header   Host $host;
        expires 7d;
        add_header Cache-Control "public, immutable";
    }
}