upstream approved_backend {
    server backend:80;
}

upstream slow_upstream {
    server slow-backend:8081;
}

# П.11: принудительный редирект HTTP -> HTTPS
server {
    listen 80;
    server_name redirect-test;

    return 301 https://$host:8443$request_uri;
}

# Основной HTTP-сервер (ПМИ п. 1-2, 4-8, 12-23)
server {
    listen 80 default_server;
    server_name nginx-test;

    root /usr/share/nginx/html/public;
    index index.html;

    error_page 404 /custom_404.html;

    location = /custom_404.html {
        root /usr/share/nginx/html/errors;
        internal;
    }

    # П.1, П.6: ограничение по IP
    location /admin/ {
        allow 172.28.0.0/16;
        deny all;
        alias /usr/share/nginx/html/public/;
        try_files /index.html =404;
    }

    # П.2: Basic Authentication
    location /secure/ {
        auth_basic           "Restricted";
        auth_basic_user_file /etc/nginx/htpasswd;
        alias /usr/share/nginx/html/public/;
        try_files /index.html =404;
    }

    # П.5: satisfy all (IP + пароль)
    location /admin-combined/ {
        satisfy all;
        allow 172.28.0.0/16;
        deny all;
        auth_basic           "Admin";
        auth_basic_user_file /etc/nginx/htpasswd;
        alias /usr/share/nginx/html/public/;
        try_files /index.html =404;
    }

    # П.4: auth_request
    location = /auth {
        internal;
        proxy_pass              http://auth-mock:9999/validate;
        proxy_pass_request_body off;
        proxy_set_header        Content-Length "";
    }

    location /auth-protected/ {
        auth_request /auth;
        proxy_pass http://approved_backend/;
    }

    # П.7: limit_except
    location /api/ {
        limit_except GET POST {
            deny all;
        }
        proxy_pass http://approved_backend/;
    }

    # П.8: internal
    location /protected/ {
        internal;
        alias /usr/share/nginx/html/protected/;
    }

    location /download {
        rewrite ^ /protected/document.pdf last;
    }

    # П.13: error log через недоступный upstream
    location /broken/ {
        proxy_connect_timeout 2s;
        proxy_read_timeout 2s;
        proxy_pass http://127.0.0.1:59999/;
    }

    # П.12: access log
    location /test-page {
        default_type text/plain;
        return 200 "test-page-ok\n";
    }

    location /another-page {
        default_type text/plain;
        return 200 "another-page-ok\n";
    }

    # П.15: limit_req
    location = /rate-limit-check {
        limit_req zone=pmi_uri burst=1 nodelay;
        limit_req_status 503;
        proxy_pass http://approved_backend/status;
    }

    location /rate-limit/ {
        limit_req zone=pmi_uri burst=1 nodelay;
        limit_req_status 503;
        proxy_pass http://approved_backend/status;
    }

    # П.16: limit_conn
    location /slow/ {
        limit_conn pmi_conn 2;
        proxy_pass http://slow_upstream/;
        proxy_read_timeout 60s;
    }

    # П.17, П.18: upload
    location /upload {
        default_type text/plain;
        return 200 "upload-ok\n";
    }

    # П.21: autoindex off
    location /files/ {
        autoindex off;
        alias /usr/share/nginx/html/files/;
    }

    location /public/ {
        alias /usr/share/nginx/html/public/;
    }

    location / {
        try_files $uri =404;
    }
}

# П.9, П.10, П.11 (HSTS): HTTPS без клиентского сертификата
server {
    listen 443 ssl;
    server_name nginx-test;

    ssl_certificate     /etc/nginx/ssl/fullchain.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers on;

    add_header Strict-Transport-Security "max-age=31536000" always;

    root /usr/share/nginx/html/public;
    index index.html;

    location / {
        try_files $uri =404;
    }
}

# П.3: mTLS (клиентский сертификат)
server {
    listen 443 ssl;
    server_name nginx-test-mtls;

    ssl_certificate         /etc/nginx/ssl/fullchain.crt;
    ssl_certificate_key     /etc/nginx/ssl/server.key;
    ssl_client_certificate  /etc/nginx/ssl/ca.crt;
    ssl_verify_client       on;
    ssl_verify_depth          2;
    ssl_protocols           TLSv1.2 TLSv1.3;

    location / {
        default_type text/plain;
        return 200 "mtls-ok\n";
    }
}