# =========================================================================
# Tailscale Firewall (Early execution at server context)
# =========================================================================
set $block_unauthorized_admin 0;

# Step 1: Check if the current URI belongs to Joomla admin or API (using $uri)
if ($uri ~* "^/(administrator|api)") {
    set $block_unauthorized_admin 1;
}

# Step 2: If the IP matches the Tailscale range (100.64.0.0/10), reset the flag
if ($remote_addr ~ "^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\.") {
    set $block_unauthorized_admin 0;
}

# Step 3: Deny access with a 403 Forbidden if the flag is still set to 1
if ($block_unauthorized_admin = 1) {
    return 403;
}

# =========================================================================
# Global Server Security: Restrict entire Subdomain to Tailscale Only
# =========================================================================
# 1. Let's Encrypt allow
location ^~ /.well-known/acme-challenge/ {
    allow all;
}

# 2. Exclude ISPConfig error pages from Tailscale restrictions
location ^~ /error/ {
    allow all;
}

# 3. Only Tailscale for everything else
allow 100.64.0.0/10;
deny all;

# =========================================================================
# Reverse Proxy Configuration
# =========================================================================
location / {
    proxy_pass http://127.0.0.1:8000;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # WebSocket support (highly recommended for modern web apps)
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";

    # Buffering tweaks
    proxy_connect_timeout 90s;
    proxy_send_timeout 90s;
    proxy_read_timeout 90s;
    proxy_buffering off;
}

# =========================================================================
# Global Server Security: Restrict entire PHP Subdomain to Tailscale Only
# =========================================================================
# 1. Let's Encrypt allow
location ^~ /.well-known/acme-challenge/ {
    allow all;
}

# 2. Exclude ISPConfig error pages from Tailscale restrictions
location ^~ /error/ {
    allow all;
}

# 3. Only Tailscale for everything else
allow 100.64.0.0/10;
deny all;