# HTTP
server {
    listen 80;
    server_name adampowell.pro;

    # If certs exist, redirect everything to HTTPS; otherwise serve HTTP directly
    return 301 https://$host$request_uri;

    # Fallback HTTP serving (used only if no HTTPS)
    root /var/www/adampowell.pro/html;
    index index.html index.htm;

    # Redirect bare /maps to login page
    location = /maps { return 302 /maps/login.html; }

    # Proxy API calls to Node app
    location /api/ {
        proxy_pass         http://127.0.0.1:3001/api/;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto http;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_read_timeout 60s;
    }

    # Proxy all /maps/ to Node app
    location /maps/ {
        proxy_pass         http://127.0.0.1:3001/;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto http;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_read_timeout 60s;
    }

    # Redirect bare /chat to /chat/
    location = /chat { return 302 /chat/; }

    # Proxy all /chat/ to Messenger app
    location /chat/ {
        proxy_pass         http://127.0.0.1:3002/;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto http;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_read_timeout 60s;
    }

    # NDA directory - PHP support
    location /nda/ {
        root /var/www/adampowell.pro;
        index index.php index.html;
        
        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.3-fpm.sock;
        }
        
        location ~ ^/nda/(records|signatures)/ {
            deny all;
            return 403;
        }
    }

    location /purchase-orders/ {
        root /var/www/adampowell.pro;
        index index.php index.html;
        
        location ~ .php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.3-fpm.sock;
        }
        
        location ~ ^/purchase-orders/.*/(?:records|signatures)/ {
            deny all;
            return 403;
        }
    }

    location / {
        try_files $uri $uri/ =404;
    }
}

# HTTPS
server {
    listen 443 ssl http2;
    server_name adampowell.pro;

    ssl_certificate     /etc/letsencrypt/live/adampowell.pro/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/adampowell.pro/privkey.pem;

    root /var/www/adampowell.pro/html;
    index index.html index.htm;

    # Login page route
    location = /login {
        proxy_pass         http://127.0.0.1:3003/login.html;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto https;
    }

    # Auth API routes - proxy to auth server
    location /auth/api/ {
        proxy_pass         http://127.0.0.1:3003/api/;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto https;
        proxy_read_timeout 60s;
    }

    # Redirect bare /maps to login page
    location = /maps { return 302 /maps/login.html; }

    # Proxy API calls to Maps Node app
    location /api/ {
        proxy_pass         http://127.0.0.1:3001/api/;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto https;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_read_timeout 60s;
    }

    # Proxy all /maps/ to Node app
    location /maps/ {
        proxy_pass         http://127.0.0.1:3001/;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto https;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_read_timeout 60s;
    }

    # Redirect bare /chat to /chat/
    location = /chat { return 302 /chat/; }

    # Proxy all /chat/ to Messenger app
    location /chat/ {
        proxy_pass         http://127.0.0.1:3002/;
        proxy_http_version 1.1;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto https;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_read_timeout 60s;
    }

    # NDA directory - PHP support
    location /nda/ {
        root /var/www/adampowell.pro;
        index index.php index.html;
        
        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.3-fpm.sock;
        }
        
        location ~ ^/nda/(records|signatures)/ {
            deny all;
            return 403;
        }
    }
        location /purchase-orders/ {
        root /var/www/adampowell.pro;
        index index.php index.html;
        
        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.3-fpm.sock;
        }
        
        location ~ ^/purchase-orders/.*/(?:records|signatures)/ {
            deny all;
            return 403;
        }
    }


    location / {
        try_files $uri $uri/ =404;
    }
}