server {
    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    server_name slpsoftware.nl www.slpsoftware.nl;

    access_log /var/log/nginx/slpsoftware_access.log;
    error_log /var/log/nginx/slpsoftware_error.log;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    # Sentry "tunnel" endpoint (zie src/main.tsx's Sentry.init tunnel-optie en
    # de toelichting in reverse-proxy-nginx.conf.example) — voorkomt dat
    # ad-blockers Sentry-events blokkeren door ze via ons eigen domein te
    # tunnelen. VITE_SENTRY_DSN is bewust gedeeld tussen test en productie
    # (één Sentry-project, environment-tag onderscheidt ze), dus dezelfde
    # org-/project-id als de testomgeving is hier correct.
    location /sentry-tunnel {
        proxy_pass https://o4511795618185216.ingest.de.sentry.io/api/4511795622838352/envelope/;
        proxy_set_header Host o4511795618185216.ingest.de.sentry.io;
        proxy_ssl_server_name on;
    }

    location ~ ^\/(iredadmin|mail)(\/|$) {
        proxy_pass https://192.168.1.104:443;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        proxy_pass http://192.168.1.103:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    ssl_certificate /etc/letsencrypt/live/slpsoftware.nl/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/slpsoftware.nl/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot

    server_name mail.slpsoftware.nl;

    access_log /var/log/nginx/mail.slpsoftware_access.log;
    error_log /var/log/nginx/mail.slpsoftware_error.log;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        proxy_pass https://192.168.1.104:443; # Odroid C4 hosting iRedMail
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    ssl_certificate /etc/letsencrypt/live/mail.slpsoftware.nl/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/mail.slpsoftware.nl/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    listen 80;
    listen [::]:80;

    server_name slpsoftware.nl www.slpsoftware.nl mail.slpsoftware.nl;

    if ($host = mail.slpsoftware.nl) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    if ($host = www.slpsoftware.nl) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    if ($host = slpsoftware.nl) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    return 404; # managed by Certbot
}