nginx_sites = {
  bitwarden = {
    #service = "nginx.bitwarden.svc:8080"
    #extra-value-location = <<EOT
    #proxy_set_header      Host $host;
    #proxy_set_header      X-Real-IP $remote_addr;
    #proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
    #proxy_set_header      Proxy "";
    #            EOT
    service    = "bitwarden-nginx-svc.bitwarden.svc:8080"
    http2_bool = true
  }

  bookstack = {
    #    service     = "webserver.bookstack.svc"
    service     = "bookstack-svc.bookstack.svc"
    proxy_cache = false
  }

  django = {
    #service     = "webserver.django-python.svc:8000"
    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true
  }
  django-dev = {
    service     = "webserver.django-dev.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  echo = {
    enabled = false
    #    service     = "echo-server.echo-server.svc:80"
    service     = "echo-svc.echo.svc"
    proxy_cache = true
    http2_bool  = true

    #extra-value-location = <<EOT
    #  auth_request /oauth2/auth;
    #  error_page 401 = @oauth2_signin;
    #  proxy_set_header X-Auth-Request-Redirect $request_uri;
    #            EOT

    #extra-value = <<EOT
    #  location = /oauth2/auth {
    #  internal;
#proxy_pass http://oauthn_backend;
##        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
    # proxy_pass_request_body off;
    #  proxy_set_header Content-Length "";
    #  proxy_set_header X-Original-URI $request_uri;
    #  proxy_set_header X-Real-IP $remote_addr;
    #  proxy_set_header X-Scheme $scheme;
    #}

    #location @oauth2_signin {
    #  return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
    #  #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
    #}

    #location /oauth2/ {
    #proxy_pass http://oauthn_backend;
    #proxy_set_header Host $host;
    #proxy_set_header X-Real-IP $remote_addr;
    #proxy_set_header X-Scheme $scheme;
    #proxy_set_header X-Auth-Request-Redirect $request_uri;
    #}

    #            EOT


  }
  gitlab = {
    service          = "webserver.gitlab.svc:443"
    proxy_cache      = true
    extra_value_bool = true
    enabled          = false
    extra-value      = <<EOT
client_max_body_size 20m;
	proxy_request_buffering off;
                EOT
    http2_bool       = true
    proxy_pass_https = true
  }
  sonarr = {
    service = "sonarr-svc.servarr.svc:8989"
  }

  keycloak = {
    service     = "keycloak.keycloak.svc:8080"
    enabled     = false
    extra-value = <<EOT

        set_real_ip_from 0.0.0.0/0;
        real_ip_header X-Real-IP;
        real_ip_recursive on;
                        EOT
  }
  nextcloud = {
    service = "webserver.nextcloud.svc"
    #    service     = "next-svc.next.svc"
    proxy_cache = true
    http2_bool  = true
    extra-value = <<EOT


        location /.well-known/carddav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location /.well-known/caldav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location = /health {
                default_type text/html;
                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
        }
                        EOT
  }



  router = {
    service                 = "192.168.88.1"
    authentication_required = true
  }
  homeassistant = {
    enabled = false
    service = "homeassistant-svc.homeassistant.svc:8123"
  }
  octoprint = {
    service = "192.168.1.28:5000"
  }
  onitama = {
    service = "onitama-svc.onitama.svc:8080"
    enabled = false
  }

  opentrashmail = {
    #                service = "opentrashmail.opentrashmail.svc"
    service = "1.1.1.1"
    enabled = false
  }
  paperless = {
    #service = "webserver.paperless.svc:8000"
    service = "paperless-svc.paperless.svc:8000"
  }
  pihole = {
    service = "172.16.0.60:8081"
    enabled = false
  }
  portainer = {
    service = "portainer.portainer.svc"
  }
  prowlarr = {
    service = "prowlarr-svc.servarr.svc:9696"
  }
  proxmox = {
    service = "192.168.6.2:8006"
    enabled = false
  }
  qbittorrent = {
    service = "qbittorrent-svc.servarr.svc:8080"
  }
  radarr = {
    service = "radarr-svc.servarr.svc:7878"
  }
  recommendarr = {
    service = "recommendarr-svc.servarr.svc:3000"
    enabled = false
  }
  reverse = {
    service = "192.168.88.50:8888"
    enabled = false
  }
  sickchill = {
    service = "sickchill.servarr.svc"
    enabled = false
  }
  transmission = {
    service = "192.168.88.52:31091"
    enabled = false
  }
  unifi = {
    #    service = "unifi.unifi.svc:8443"
    service          = "192.168.88.244:8443"
    proxy_pass_https = true
  }
  unifi-inform = {
    service = "192.168.88.50:8082"
  }
  dupeguru = {
    service                 = "dupeguru.dupeguru.svc:5800"
    enabled                 = false
    authentication_required = true
  }

  immich = {
    #service = "immich-server.immich.svc:2283"
    service              = "immich-svc.immich.svc:2283"
    extra-value-location = <<EOT
       proxy_set_header Connection "upgrade";
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_read_timeout 60000s;


    #adding websocket , usefull for reverse proxy
       proxy_set_header Connection "upgrade";
       proxy_set_header X-Real-IP $remote_addr;
       proxy_cache_bypass $http_upgrade;
    #end of working
                EOT  
  }
  immicht = {
    service = "immicht-svc.immicht.svc:2283"
    enabled = false
  }

  netdata = {
    enabled = false
    service = "netdata-agent.netdata.svc:19999"
  }
  screeps = {
    enabled                = false
    redirect_to_https_bool = false
    listen_port_80_bool    = true
    service                = "screeps-svc.screeps.svc:21025"
  }

  stirling = {
    enabled              = false
    service              = "stirling-svc.stirling.svc:8080"
    extra-value-location = <<EOT
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;
#end of working



                EOT
  }
  vulcan = {
    service = "vulcan.vulcan.svc:80"
    enabled = false
  }
  djangoterra = {
    enabled = false
    service = "djangoterra-svc.djangoterra.svc:8000"
  }

  nginx = {
    enabled = false
    service = "nginx-svc.nginx.svc"
  }
  openmediavault = {
    service = "192.168.88.29"
    #    service = "192.168.88.42"
  }
  pihole = {
    service = "web.piholenew.svc"
  }
  jellyfin = {
    #  enabled = false
    service = "jellyfin-svc.jellyfin.svc:8096"
  }
  gogs = {
    enabled = false
    service = "gogs-svc.gogs.svc:3000"
  }
  synology = {
    enabled = true
    service = "192.168.88.39:5000"
  }

  gitea = {
    enabled = true
    service = "webserver.gitea.svc:3000"
  }

  spider = {
    enabled = false
    service = "spider-svc.spider.svc:8080"
  }
  nextcloud-terraform = {
    enabled = false
    service = "nextcloud-web-svc.nextcloud-terraform.svc:80"

  }
  paper = {
    enabled = false
    service = "paper-svc.paper.svc:8000"

  }
  next = {
    enabled     = false
    service     = "next-svc.next.svc"
    proxy_cache = true
    http2_bool  = true
    extra-value = <<EOT


        location /.well-known/carddav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location /.well-known/caldav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location = /health {
                default_type text/html;
                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
        }
                        EOT
  }

  bookstack-terraform = {
    enabled = false
    service = "bookstack-svc.bookstack-terraform.svc"
  }
  stash = {
    #  enabled              = false
    service = "stash-svc.stash.svc:9999"
    #extra-value= <<EOT
    #   proxy_protocol on;
    #EOT
    extra-value-location = <<EOT
    #don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
    #Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
    #proxy_bind $remote_addr transparent;

##used to be working
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60000s;
    #working
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;
    #end of working
    EOT

  }
  neko = {
    enabled              = false
    service              = "neko-svc.neko.svc:8080"
    http2_bool           = true
    extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;

                EOT

  }
  pinchflat = {
    enabled = false
    service = "pinchflat-svc.pinchflat.svc:8945"
  }

  jobspy = {
    enabled = false
    service = "jobspy-svc.jobspy.svc:8000"
  }
  tprowlarr = {
    enabled = false
    service = "prowlarr-svc.tservarr.svc:9696"
  }
  tradarr = {
    enabled = false
    service = "radarr-svc.tservarr.svc:7878"
  }
  tsonarr = {
    enabled = false
    service = "sonarr-svc.tservarr.svc:8989"
  }
  tqbitorrent = {
    enabled = false
    service = "qbitorrent-svc.tservarr.svc:8080"
  }

  poste = {
    enabled              = false
    service              = "poste-svc.poste.svc:443"
    proxy_pass_https     = true
    extra-value-location = <<EOT
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;
#end of working



                EOT
  }
  wikijs = {
    #enabled     = false
    service     = "wikijs-svc.wikijs.svc:3000"
    extra-value = <<EOT
client_max_body_size 20m;
        proxy_request_buffering off;
                EOT
  }

  keycloak = {
    enabled     = false
    service     = "keycloak-svc.keycloak.svc:8080"
    extra-value = <<EOT

        set_real_ip_from 0.0.0.0/0;
        real_ip_header X-Real-IP;
        real_ip_recursive on;
                        EOT
  }
  oauthn = {
    enabled = false
    service = "oauth2-proxy-svc.oauth2-proxy.svc:4180"

    # extra-value = <<EOT
    # location /oauth2/ {
    #	proxy_pass http://oauthn_backend;
    #	proxy_set_header Host $host;
    #	proxy_set_header X-Real-IP $remote_addr;
    #	proxy_set_header X-Scheme $scheme;
    #   }
    #              EOT


  }
  emailproxy = {
    enabled = false
    service = "emailproxy-svc.paper.svc:80"
  }
  tdarr = {
    #enabled = false
    service              = "tdarr-svc.servarr.svc:8265"
    extra-value-location = <<EOT
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;
#end of working



                EOT

  }

}
deny_ip = ["1.2.3.4"]