# nginx server block：*.apps.ffworkspace.test.faradayfuturecn.com → Caddy 127.0.0.1:8080
#
# 部署：
#   sudo install -m 0644 nginx-site-wildcard.test.conf \
#        /etc/nginx/sites-available/internal-apps-wildcard
#   sudo ln -sf /etc/nginx/sites-available/internal-apps-wildcard \
#        /etc/nginx/sites-enabled/internal-apps-wildcard
#   sudo nginx -t && sudo systemctl reload nginx
#
# 前置：
#   1. wildcard cert 已放到 /etc/ssl/internal-app-platform/wildcard-apps.{crt,key}
#      （test 环境可以先用自签：见 scripts/internal-app-platform/gen-self-signed-wildcard.sh）
#   2. Caddy 容器已在 127.0.0.1:8080 上跑：bash setup-test-server.sh 后会自动检测共机模式
#
# 参考：docs/modules/internal-app-platform/12-nginx-caddy-coexist.md §5

server {
    listen 80;
    listen [::]:80;
    server_name *.apps.ffworkspace.test.faradayfuturecn.com;

    # 给未来 LE HTTP-01 续期留一个 well-known 路径（DNS-01 不需要也无害）
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name *.apps.ffworkspace.test.faradayfuturecn.com;

    ssl_certificate     /etc/ssl/internal-app-platform/wildcard-apps.crt;
    ssl_certificate_key /etc/ssl/internal-app-platform/wildcard-apps.key;
    # 复用 certbot 已经生成的 TLS 强化参数
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    client_max_body_size 50M;

    # 反代到 Caddy（HTTP，内网明文）。Caddy 内部 import /etc/caddy/sites/*.caddy
    # ffoa-deploy 每次部署会往 /srv/caddy/sites/<emp>-<app>.caddy 写新文件 + admin API reload
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}
