# =========================================================
# BreakPilot Nginx Reverse Proxy (Split-Architektur)
# =========================================================
# Core: Infrastruktur, Auth, RAG
# Lehrer: Studio, Admin-Lehrer, Klausur, Voice
# Compliance: Admin-Compliance, SDK, Developer Portal
# =========================================================

# Docker internal DNS resolver (ipv6=off to avoid unreachable IPv6 addresses)
resolver 127.0.0.11 valid=10s ipv6=off;

# HTTP -> HTTPS redirect
server {
    listen 80;
    server_name macmini localhost;
    return 301 https://$host$request_uri;
}

# =========================================================
# LEHRER: Studio v2 on port 443
# =========================================================
server {
    listen 443 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # Jitsi WebSocket endpoints
    location /xmpp-websocket {
        set $upstream_jitsi bp-core-jitsi-web:80;
        proxy_pass http://$upstream_jitsi;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
    }

    location /colibri-ws {
        set $upstream_jvb bp-core-jitsi-jvb:9090;
        proxy_pass http://$upstream_jvb;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
    }

    location /http-bind {
        set $upstream_jitsi bp-core-jitsi-web:80;
        proxy_pass http://$upstream_jitsi;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    # Jitsi static assets
    location ~ ^/(css|images|fonts|sounds|static|libs|lang|connection_optimization)/ {
        set $upstream_jitsi bp-core-jitsi-web:80;
        proxy_pass http://$upstream_jitsi;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    location ~ ^/(config\.js|interface_config\.js|logging_config\.js|external_api\.js|external_api\.min\.js|favicon\.ico|robots\.txt|manifest\.json|pwa-worker\.js) {
        set $upstream_jitsi bp-core-jitsi-web:80;
        proxy_pass http://$upstream_jitsi;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    location /jitsi/ {
        set $upstream_jitsi bp-core-jitsi-web:80;
        rewrite ^/jitsi(/.*)$ $1 break;
        proxy_pass http://$upstream_jitsi;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    # Klausur Service same-origin proxy
    location /klausur-api/ {
        set $upstream_klausur bp-lehrer-klausur-service:8086;
        rewrite ^/klausur-api(/.*)$ $1 break;
        proxy_pass http://$upstream_klausur;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        client_max_body_size 50M;
        proxy_read_timeout 300s;
    }

    # Studio v2
    location / {
        set $upstream_studio bp-lehrer-studio-v2:3001;
        proxy_pass http://$upstream_studio;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# LEHRER: Website on port 3000
# =========================================================
server {
    listen 3000 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location / {
        set $upstream_website bp-lehrer-website:3000;
        proxy_pass http://$upstream_website;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# LEHRER: Admin Lehrer on port 3002
# =========================================================
server {
    listen 3002 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # Klausur Service same-origin proxy
    location /klausur-api/ {
        set $upstream_klausur bp-lehrer-klausur-service:8086;
        rewrite ^/klausur-api(/.*)$ $1 break;
        proxy_pass http://$upstream_klausur;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        client_max_body_size 50M;
        proxy_read_timeout 300s;
    }

    # Docs proxy
    location /docs/ {
        set $upstream_docs bp-lehrer-docs:80;
        rewrite ^/docs(/.*)$ $1 break;
        proxy_pass http://$upstream_docs;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    # Admin Lehrer Frontend
    location / {
        set $upstream_admin_lehrer bp-lehrer-admin:3000;
        proxy_pass http://$upstream_admin_lehrer;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# COMPLIANCE: Admin Compliance on port 3007 (NEU)
# =========================================================
server {
    listen 3007 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # SDK API proxy (same origin)
    location /sdk/v1/ {
        set $upstream_sdk bp-compliance-ai-sdk:8090;
        proxy_pass http://$upstream_sdk;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 300s;
        proxy_connect_timeout 60s;
        proxy_send_timeout 300s;
    }

    # Docs proxy
    location /docs/ {
        set $upstream_docs bp-compliance-docs:80;
        rewrite ^/docs(/.*)$ $1 break;
        proxy_pass http://$upstream_docs;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }

    # Admin Compliance Frontend
    location / {
        set $upstream_admin_compliance bp-compliance-admin:3000;
        proxy_pass http://$upstream_admin_compliance;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}


# =========================================================
# CORE: Admin Core on port 3008 (NEU)
# =========================================================
server {
    listen 3008 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    # Admin Core Frontend
    location / {
        set $upstream_admin_core bp-core-admin:3000;
        proxy_pass http://$upstream_admin_core;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# CORE: Backend Core on port 8000
# =========================================================
server {
    listen 8000 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location / {
        set $upstream_backend bp-core-backend:8000;
        proxy_pass http://$upstream_backend;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# LEHRER: Backend Lehrer on port 8001 (NEU)
# =========================================================
server {
    listen 8001 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location / {
        set $upstream_lehrer bp-lehrer-backend:8001;
        proxy_pass http://$upstream_lehrer;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# COMPLIANCE: Backend Compliance on port 8002 (NEU)
# =========================================================
server {
    listen 8002 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location / {
        set $upstream_compliance bp-compliance-backend:8002;
        proxy_pass http://$upstream_compliance;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# LEHRER: Klausur Service on port 8086
# =========================================================
server {
    listen 8086 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    client_max_body_size 50M;

    location / {
        set $upstream_klausur bp-lehrer-klausur-service:8086;
        proxy_pass http://$upstream_klausur;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# CORE: Embedding Service on port 8087
# =========================================================
server {
    listen 8087 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location / {
        set $upstream_embedding bp-core-embedding-service:8087;
        proxy_pass http://$upstream_embedding;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# LEHRER: Voice Service on port 8091 (WebSocket)
# =========================================================
server {
    listen 8091 ssl;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location /ws/ {
        set $upstream_voice bp-lehrer-voice-service:8091;
        proxy_pass http://$upstream_voice;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
    }

    location / {
        set $upstream_voice bp-lehrer-voice-service:8091;
        proxy_pass http://$upstream_voice;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# COMPLIANCE: AI Compliance SDK on port 8093
# =========================================================
server {
    listen 8093 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    client_max_body_size 10M;

    location / {
        set $upstream_sdk bp-compliance-ai-sdk:8090;
        proxy_pass http://$upstream_sdk;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 300s;
        proxy_connect_timeout 60s;
        proxy_send_timeout 300s;
    }
}

# =========================================================
# CORE: RAG Service on port 8097 (NEU)
# =========================================================
server {
    listen 8097 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    client_max_body_size 50M;

    location / {
        set $upstream_rag bp-core-rag-service:8097;
        proxy_pass http://$upstream_rag;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 300s;
    }
}

# =========================================================
# CORE: Edu-Search on port 8089
# =========================================================
server {
    listen 8089 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location / {
        set $upstream_edu_search breakpilot-edu-search:8088;
        proxy_pass http://$upstream_edu_search;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# COMPLIANCE: Developer Portal on port 3006
# =========================================================
server {
    listen 3006 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location / {
        set $upstream_devportal bp-compliance-developer-portal:3000;
        proxy_pass http://$upstream_devportal;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# CORE: Jitsi Meet on port 8443
# =========================================================
server {
    listen 8443 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;

    location /xmpp-websocket {
        set $upstream_jitsi bp-core-jitsi-web:80;
        proxy_pass http://$upstream_jitsi;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
    }

    location /colibri-ws {
        set $upstream_jvb bp-core-jitsi-jvb:9090;
        proxy_pass http://$upstream_jvb;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 86400;
        proxy_send_timeout 86400;
    }

    location / {
        set $upstream_jitsi bp-core-jitsi-web:80;
        proxy_pass http://$upstream_jitsi;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

# =========================================================
# PORTAL: Static Dashboard on port 3010
# =========================================================
server {
    listen 3010 ssl;
    http2 on;
    server_name macmini localhost;

    ssl_certificate /etc/nginx/certs/macmini.crt;
    ssl_certificate_key /etc/nginx/certs/macmini.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    root /usr/share/nginx/html/portal;

    location / {
        try_files $uri $uri/ /index.html;
    }
}