map "$http_upgrade_insecure_requests:$scheme" $do_upgrade {
        "1:http"   1;
        default    0;
}

map $request_method $var_auth_basic {
   default "Restricted";
   GET off;
   HEAD off;
}

server {
        # Listen
        listen 443 quic reuseport;
        listen [::]:443 quic reuseport;
        listen 443 ssl;
        listen [::]:443 ssl;
        listen 80;
        listen [::]:80;
        server_name swee.codes;

        # other 101% important nginx stuff

        index index.php index.html index.htm;
        root /var/www/swee.codes;
        error_page 404 /errors/404.html;
        error_page 418 /errors/418.html;
        error_page 500 /errors/500.html;
        error_page 502 /errors/502.html;

        # Headers
        add_header 'Access-Control-Allow-Origin' '*';
        add_header "Cache-Control" "public, max-age=300";
        add_header "X-Frame-Policy" "SAMEORIGIN";
        # TODO: Find a way to fix the header adding without setting it her
        add_header Alt-Svc 'h3=":443"; ma=86400, h3-29=":443"; ma=86400' always;
        add_header x-quic 'h3' always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

        # Upgrade HTTP if required
        if ($do_upgrade) {
                return 302 https://$host$request_uri;
        }

        # Rewrite PHP if exists
        location / {
                if (-e $request_filename.php){
                        rewrite ^/(.*)$ /$1.php;
                }
                try_files $uri $uri.html $uri.htm $uri/ /special.php$request_uri;
        }

        # Fancy directory listings
        fancyindex on;
        fancyindex_exact_size off;
        fancyindex_css_href "https://cdn.swee.codes/assets/fancyindex.css";

        # Handle PHP
        location ~ \.php(?:$|/) {
                fastcgi_split_path_info ^(.+\.php)(/.*)$;
                fastcgi_pass 127.0.0.1:9000;
                fastcgi_index index.php;
                include fastcgi_params;
                include fastcgi.conf;
                fastcgi_param PATH_INFO $fastcgi_path_info;
                fastcgi_intercept_errors on;
        }

        # Block sensitive directories
        location /.git {
                return 418;
        }

        # OCI registry
        location /v2/ {
                client_max_body_size 5G;
                proxy_pass http://127.0.0.1:5678/v2/;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_http_version 1.1;
                proxy_set_header Connection "";
                chunked_transfer_encoding off;

                auth_basic $var_auth_basic;
                auth_basic_user_file /etc/registry/htpasswd;
        }

        # Proxy matrix client

        location ~ ^/_(matrix|synapse)/client {
                proxy_pass https://matrix.swee.codes;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header Host $host;
                proxy_http_version 1.1;
        }


        # Redirect sweetlogo to its repo

        location ~ ^/sweetlogo.(.*)$ {
                return 301 https://git.swee.codes/swee/sweetlogo/raw/branch/main/sweetlogo.$1;
        }

        # Redirect uploads to R2

        location ~ ^/uploads/(.*)$ {
                return 301 https://cdn.swee.codes/uploads/$1;
        }

        # Redirect apt repo to cdn2

        location ~ ^/apt-repo/(.*)$ {
                return 301 https://debian.pkg.swee.codes/$1;
        }

        # TODO: Use this again when chainlink is up

        #location /u/ {
                #rewrite /u/(.*) /$1 break;
                #proxy_pass https://u.swee.codes/;
                #proxy_ssl_server_name on;
                #proxy_set_header Host u.swee.codes;
        #}

        # Certbot shit

        ssl_certificate /etc/letsencrypt/live/swee.codes/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/swee.codes/privkey.pem; # managed by Certbot
        include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}