nginx_sites = {
  bitwarden = {
    service                 = "bitwarden-nginx-svc.bitwarden.svc:8080"
    http2_bool              = true
    redirect_to_root_domain = false
  }

  bookstack = {
    enabled     = false
    service     = "bookstack-svc.bookstack.svc"
    proxy_cache = false
  }


  django = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  admin = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  redirect = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  streaming = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  stash = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  simpsons = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  kubernetes = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  cloudmanager = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  podcast = {
    enabled = false

    service     = "django-svc.django:8000"
    proxy_cache = true
    http2_bool  = true

  }
  django-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  admin-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  redirect-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  streaming-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  stash-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  simpsons-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  kubernetes-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }

  cloudmanager-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }
  podcast-testing = {
    service     = "django-testing-svc.django-testing.svc:8000"
    proxy_cache = true
    http2_bool  = true
  }
  echo = {
    enabled        = true
    service        = "echo-svc.echo.svc"
    docker_service = "echo-svc.echo.svc"
    proxy_cache    = true
    http2_bool     = true
  }

  sonarr = {
    enabled = false

    service     = "sonarr-svc.servarr.svc:8989"
    geoip_allow = ["FR", "GB", "NL"]

  }


  nextcloud = {
    enabled = false

    redirect_to_root_domain = false
    service                 = "webserver.nextcloud.svc"
    #service     = "nextcloud-svc.next.svc"
    proxy_cache = true
    http2_bool  = true
    extra-value = <<EOT


        location /.well-known/carddav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location /.well-known/caldav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location = /health {
                default_type text/html;
                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
        }
                        EOT
  }



  router = {
    enabled = false

    service                 = "192.168.88.1"
    authentication_required = true
  }

  octoprint = {

    service              = "192.168.0.32:5000"
    extra-value-location = <<EOT
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme; # Crucial for HTTPS to HTTP matching
    
    # Required for OctoPrint WebSockets to function properly
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    
    client_max_body_size 0;    # Allows large file uploads like gcode
                EOT

  }
  onitama = {
    service = "onitama-svc.onitama.svc:8080"
    enabled = false
  }


  paperless = {
    enabled = false

    #service = "webserver.paperless.svc:8000"
    service = "paperless-svc.paperless.svc:8000"
  }
  pihole = {
    enabled = false

    service = "172.16.0.60:8081"
    enabled = false
  }

  prowlarr = {
    enabled = false

    service     = "prowlarr-svc.servarr.svc:9696"
    geoip_allow = ["FR", "GB", "NL"]

  }

  qbittorrent = {
    enabled     = false
    service     = "qbittorrent-svc.servarr.svc:8080"
    geoip_allow = ["FR", "GB", "NL"]

  }
  radarr = {
    enabled = false

    service     = "radarr-svc.servarr.svc:7878"
    geoip_allow = ["FR", "GB", "NL"]

  }


  unifi = {
    enabled = false

    #    service = "unifi.unifi.svc:8443"
    service          = "192.168.88.244:8443"
    proxy_pass_https = true
  }
  unifi-inform = {
    enabled = false

    service = "192.168.88.50:8082"
  }


  immich = {
    enabled = false

    #service = "immich-server.immich.svc:2283"
    service              = "immich-svc.immich.svc:2283"
    geoip_allow          = ["FR", "GB", "NL"]
    extra-value-location = <<EOT
       proxy_set_header Connection "upgrade";
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_read_timeout 60000s;


    #adding websocket , usefull for reverse proxy
       proxy_set_header Connection "upgrade";
       proxy_set_header X-Real-IP $remote_addr;
       proxy_cache_bypass $http_upgrade;
    #end of working
                EOT  
  }



  stirling = {
    enabled              = false
    service              = "stirling-svc.stirling.svc:8080"
    extra-value-location = <<EOT
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;
#end of working



                EOT
  }



  openmediavault = {
    service = "192.168.88.29"
  }
  pihole = {
    enabled = false
    service = "web.piholenew.svc"
  }

  synology = {
    enabled = true
    service = "192.168.88.39:5000"
  }

  gitea = {
    enabled                 = true
    service                 = "webserver.gitea.svc:3000"
    docker_service          = "webserver.gitea.svc:3000"
    redirect_to_root_domain = false
  }

  next = {
    enabled     = false
    service     = "next-svc.next.svc"
    proxy_cache = true
    http2_bool  = true
    extra-value = <<EOT


        location /.well-known/carddav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location /.well-known/caldav {
                return 301 $scheme://$host/remote.php/dav;
        }

        location = /health {
                default_type text/html;
                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
        }
                        EOT
  }


  stash = {
    enabled = false
    service = "stash-svc.stash.svc:9999"
    #geoip_blocking = false
    #extra-value= <<EOT
    #   proxy_protocol on;
    #EOT
    extra-value-location = <<EOT
    #don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
    #Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
    #proxy_bind $remote_addr transparent;

##used to be working
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60000s;
    #working
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;
    #end of working
    EOT

    geoip_allow = ["FR", "GB", "NL"]
  }
  neko = {
    enabled              = false
    service              = "neko-svc.neko.svc:8080"
    http2_bool           = true
    extra-value-location = <<EOT
proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;

                EOT

  }




  wikijs = {
    #enabled     = false
    geoip_blocking = false
    service        = "wikijs-svc.wikijs.svc:3000"
    extra-value    = <<EOT
client_max_body_size 20m;
        proxy_request_buffering off;
                EOT
  }




  tdarr = {
    enabled              = false
    service              = "tdarr-svc.servarr.svc:8265"
    extra-value-location = <<EOT
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 60000s;
#working
proxy_set_header Connection "upgrade";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_cache_bypass $http_upgrade;
#end of working



                EOT

  }

}
deny_ip = ["1.2.3.4"]