# P2P Video Streaming - Plain HTML with SSL
# Proxies to Python HTTP server on port 8080

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name streamed.geijutsu.work;
    return 301 https://$server_name$request_uri;
}

# HTTPS server
server {
    listen 443 ssl http2;
    server_name streamed.geijutsu.work;

    # SSL certificates from Let's Encrypt
    ssl_certificate /etc/letsencrypt/live/streamed.geijutsu.work/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/streamed.geijutsu.work/privkey.pem;

    # SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # Broadcast page with optional room slug
    location /broadcast {
        rewrite ^/broadcast(/.*)?$ /broadcast.html break;
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # Watch page with optional room slug
    location /watch {
        rewrite ^/watch(/.*)?$ /watch.html break;
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }

    # WebSocket proxy to signaling server
    location /ws {
        proxy_pass http://127.0.0.1:8888;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Static files and root
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}
