# OPSİYONEL — Ayrı alt alan adı (livekit.novazeka.com.tr) kullanmak isteyenler için.
# Önerilen: nginx-livekit-novazeka-root.snippet.conf — tek novazeka.com.tr, ek DNS yok.
#
# Örnek: wss://livekit.novazeka.com.tr → 127.0.0.1:7880
# sites-enabled'a symlink; certbot ile sertifika: livekit.novazeka.com.tr
# http { } içinde bir kez: map $http_upgrade $connection_upgrade { default upgrade; '' close; }

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl http2;
    server_name livekit.novazeka.com.tr;

    # fullchain.pem şart (ara sertifika); yalnızca cert.pem kullanmayın — ERR_CERT_AUTHORITY_INVALID
    ssl_certificate     /etc/letsencrypt/live/livekit.novazeka.com.tr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/livekit.novazeka.com.tr/privkey.pem;

    # Flutter web /rtc/validate — access_token çok uzun query string (JWT). Varsayılan Nginx
    # limiti 414 Request-URI Too Large veya "Failed to fetch" üretebilir.
    large_client_header_buffers 8 64k;
    client_header_buffer_size 16k;

    location / {
        if ($request_method = OPTIONS) {
            add_header Access-Control-Allow-Origin $http_origin always;
            add_header Access-Control-Allow-Methods 'GET, HEAD, POST, OPTIONS' always;
            add_header Access-Control-Allow-Headers $http_access_control_request_headers always;
            add_header Access-Control-Max-Age 86400 always;
            return 204;
        }

        proxy_pass http://127.0.0.1:7880;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400;
        proxy_buffering off;

        add_header Access-Control-Allow-Origin $http_origin always;
        add_header Access-Control-Expose-Headers 'Grpc-Status, Grpc-Message, Grpc-Encoding, Grpc-Accept-Encoding' always;
    }
}

server {
    listen 80;
    server_name livekit.novazeka.com.tr;
    return 301 https://$host$request_uri;
}