# HTTP Server - Redirect Configuration
server {
    listen 80;
    server_name _;

    # Logs
    access_log /var/log/nginx/softswitch_access.log;
    error_log /var/log/nginx/softswitch_error.log;

    # Exclude ACME challenge from redirect
    location ^~ /.well-known/acme-challenge/ {
        alias /var/www/softswitch/.well-known/acme-challenge/;
        default_type "text/plain";
    }

    # Force HTTPS Redirect
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS Server - Main Proxy Configuration
server {
    listen 443 ssl;
    http2 on;
    server_name _;

    # SSL Configuration (using self-signed generated during install)
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
    
    # Modern SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # Logs
    access_log /var/log/nginx/softswitch_ssl_access.log;
    error_log /var/log/nginx/softswitch_ssl_error.log;

    # ── Backend Billing API Proxy (Port 4001) ──
    # IMPORTANT: Must come BEFORE the generic /api/ block
    location /api/billing/ {
        proxy_pass http://127.0.0.1:4001;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 300s;
        proxy_connect_timeout 60s;
        proxy_send_timeout 300s;

        client_max_body_size 100M;
    }

    # ── Backend API Proxy (PBX/Admin on port 3001) ──
    location /api/ {
        proxy_pass http://127.0.0.1:3001;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        proxy_read_timeout 300s;
        proxy_connect_timeout 300s;
        proxy_send_timeout 300s;
        
        client_max_body_size 100M;
    }

    # ── Backend WebSockets Proxy (PBX CLI, Realtime) ──
    location /ws/ {
        proxy_pass http://127.0.0.1:3001;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        
        proxy_read_timeout 86400;
        proxy_connect_timeout 300s;
        proxy_send_timeout 86400;
    }

    # ── FreeSWITCH WebRTC Proxy (WSS on port 7443) ──
    location /webrtc {
        proxy_pass https://$server_addr:7443;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        
        proxy_read_timeout 86400;
        proxy_connect_timeout 300s;
        proxy_send_timeout 86400;

        # Disable SSL verification for internal FreeSWITCH WSS connection
        proxy_ssl_verify off;
    }

    # Provisioning (device configuration files)
    location /provisioning/ {
        alias /var/www/softswitch/uploads/provisioning/;
    }

    # User Portal (Extension Users)
    location /portal/ {
        alias /var/www/softswitch/portal/;
        index index.html;

        error_page 418 = @vite_dev_portal;
        if (!-f /var/www/softswitch/portal/index.html) {
            return 418;
        }

        try_files $uri $uri/ @portal_index;
    }
    location @portal_index {
        # Serve SPA index for any unmatched subroute (e.g. /portal/settings)
        root /var/www/softswitch/portal;
        try_files /index.html =404;
    }
    location = /portal {
        return 301 /portal/;
    }

    # Billing System
    location /billing/ {
        proxy_pass http://127.0.0.1:5176;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Phonebook Public Discovery
    location /phonebook/ {
        proxy_pass http://127.0.0.1:3001;
        
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Switchboard Application (Monitoring Dashboard)
    location /switchboard/ {
        alias /var/www/softswitch/switchboard/;
        index index.html;

        error_page 418 = @vite_dev_switchboard;
        if (!-f /var/www/softswitch/switchboard/index.html) {
            return 418;
        }

        try_files $uri $uri/ @switchboard_index;
    }
    location @switchboard_index {
        # Serve SPA index for any unmatched subroute (e.g. /switchboard/settings, /switchboard/settings/roles)
        root /var/www/softswitch/switchboard;
        try_files /index.html =404;
    }
    location = /switchboard {
        return 301 /switchboard/;
    }

    # Monitoring API Proxy (Switchboard Backend on port 3500)
    location /monitoring-api/ {
        rewrite ^/monitoring-api/(.*) /$1 break;
        proxy_pass http://127.0.0.1:3500;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Monitoring WebSocket (for real-time updates)
    location /monitoring-ws {
        rewrite ^/monitoring-ws$ /ws break;
        rewrite ^/monitoring-ws/(.*)$ /ws/$1 break;
        proxy_pass http://127.0.0.1:3500;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        
        proxy_read_timeout 86400;
    }

    # Static uploads (media files, branding assets)
    location /uploads/ {
        alias /var/www/softswitch/uploads/;
        expires 30d;
        add_header Cache-Control "public, immutable";
    }

    error_page 418 = @vite_dev;

    # Frontend (Production Static / Development Vite Fallback)
    location / {
        root /var/www/softswitch;
        index index.html;

        # Si index.html no existe, significa que el frontend no ha sido compilado
        # asumiendo que estamos en modo desarrollo (npm run dev).
        if (!-f /var/www/softswitch/index.html) {
            return 418;
        }

        try_files $uri $uri/ /index.html;
    }

    # Vite Development Proxy Fallbacks
    location @vite_dev {
        proxy_pass http://127.0.0.1:5173;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location @vite_dev_portal {
        rewrite ^/portal/(.*) /$1 break;
        proxy_pass http://127.0.0.1:3003;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location @vite_dev_switchboard {
        rewrite ^/switchboard/(.*) /$1 break;
        proxy_pass http://127.0.0.1:5175;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location @vite_dev_billing {
        proxy_pass http://127.0.0.1:5176;
        
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}


