##
## HTTP → HTTPS
##
server {
    listen 80;
    listen [::]:80;

    server_name portainer.ariazonaa.net;

    access_log /var/log/nginx/portainer.ariazonaa.net.access.log;
    error_log  /var/log/nginx/portainer.ariazonaa.net.error.log warn;

    return 301 https://$host$request_uri;
}

##
## HTTPS
##
server {
    listen 443;
    listen [::]:443;

    server_name portainer.ariazonaa.net;

    access_log /var/log/nginx/portainer.ariazonaa.net.access.log;
    error_log  /var/log/nginx/portainer.ariazonaa.net.error.log warn;

    ##
    ## TLS – acme.sh (DNS-01, Wildcard-Cert)
    ##
    ssl_certificate     /etc/ssl/certs/ariazonaa.net.pem;
    ssl_certificate_key /etc/ssl/private/ariazonaa.net.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    keepalive_timeout 65s;
    client_max_body_size 50m;

    ##
    ## Reverse Proxy (Portainer, WebSocket-fähig)
    ##
    location / {
        proxy_pass http://10.89.1.22:9000;

        proxy_http_version 1.1;
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        proxy_connect_timeout 10s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;

        proxy_buffers     16 16k;
        proxy_buffer_size 16k;
    }
}
