# WebSocket 升级头透传：客户端带 Upgrade 头（WS 握手）时 Connection 置 upgrade，普通请求保持 close
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# Gitea（gitea.animal-spot.icu → 3000）
server {
    listen 80;
    server_name gitea.animal-spot.icu;
    client_max_body_size 100m;

    location / {
        proxy_pass http://__API_HOST__:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # WebSocket 升级头透传
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
}

# Gitea HTTPS（证书覆盖 gitea.animal-spot.icu / www.gitea.animal-spot.icu）
server {
    listen 443 ssl;
    server_name gitea.animal-spot.icu;
    ssl_certificate /etc/nginx/ssl/gitea.animal-spot.icu.pem;
    ssl_certificate_key /etc/nginx/ssl/gitea.animal-spot.icu.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    client_max_body_size 100m;

    location / {
        proxy_pass http://__API_HOST__:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # WebSocket 升级头透传
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
}

# 顶级域名/HTTPS（证书覆盖 animal-spot.icu / www.animal-spot.icu）
server {
    listen 443 ssl default_server;
    server_name animal-spot.icu www.animal-spot.icu;
    ssl_certificate /etc/nginx/ssl/animal-spot.icu.pem;
    ssl_certificate_key /etc/nginx/ssl/animal-spot.icu.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    client_max_body_size 100m;

    location / {
        proxy_pass http://__API_HOST__:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # WebSocket 升级头透传
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
}

# 其余所有域名 → 项目管理（8080）
server {
    listen 80 default_server;
    server_name _;
    client_max_body_size 100m;

    location / {
        proxy_pass http://__API_HOST__:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # WebSocket 升级头透传
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }
}