# proxy-vm/nginx/locations.conf
# Shared location blocks — included by both HTTP and HTTPS server blocks.

# --- Health check (no auth) ---
location = /health {
    access_log off;
    default_type application/json;
    return 200 '{"status":"ok","version":"1.0"}';
}

# --- ElevenLabs ---
location /elevenlabs/ {
    if ($allowed_ip = 0) {
        return 403 '{"error":"ip_not_allowed"}';
    }
    if ($auth_ok = 0) {
        return 403 '{"error":"invalid_token"}';
    }

    set $elevenlabs_upstream https://api.elevenlabs.io;
    rewrite ^/elevenlabs/(.*) /$1 break;

    proxy_pass $elevenlabs_upstream;
    proxy_ssl_server_name on;
    proxy_ssl_name api.elevenlabs.io;
    proxy_ssl_protocols TLSv1.2 TLSv1.3;

    proxy_set_header Host api.elevenlabs.io;
    proxy_set_header Connection "";

    proxy_set_header X-Forwarded-For "";
    proxy_set_header X-Real-IP "";
    proxy_set_header True-Client-IP "";
    proxy_set_header CF-Connecting-IP "";
    proxy_set_header X-Client-IP "";
    proxy_set_header Forwarded "";
    proxy_set_header Via "";

    proxy_set_header X-Proxy-Token "";

    proxy_http_version 1.1;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_read_timeout 120s;
    proxy_send_timeout 120s;
}

# --- OpenAI ---
location /openai/ {
    if ($allowed_ip = 0) {
        return 403 '{"error":"ip_not_allowed"}';
    }
    if ($auth_ok = 0) {
        return 403 '{"error":"invalid_token"}';
    }

    set $openai_upstream https://api.openai.com;
    rewrite ^/openai/(.*) /$1 break;

    proxy_pass $openai_upstream;
    proxy_ssl_server_name on;
    proxy_ssl_name api.openai.com;
    proxy_ssl_protocols TLSv1.2 TLSv1.3;

    proxy_set_header Host api.openai.com;
    proxy_set_header Connection "";

    proxy_set_header X-Forwarded-For "";
    proxy_set_header X-Real-IP "";
    proxy_set_header True-Client-IP "";
    proxy_set_header CF-Connecting-IP "";
    proxy_set_header X-Client-IP "";
    proxy_set_header Forwarded "";
    proxy_set_header Via "";

    proxy_set_header X-Proxy-Token "";

    proxy_http_version 1.1;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_read_timeout 120s;
    proxy_send_timeout 120s;
}

# --- Telegram Bot API ---
location /telegram/ {
    if ($allowed_ip = 0) {
        return 403 '{"error":"ip_not_allowed"}';
    }
    if ($auth_ok = 0) {
        return 403 '{"error":"invalid_token"}';
    }

    set $telegram_upstream https://api.telegram.org;
    rewrite ^/telegram/(.*) /$1 break;

    proxy_pass $telegram_upstream;
    proxy_ssl_server_name on;
    proxy_ssl_name api.telegram.org;
    proxy_ssl_protocols TLSv1.2 TLSv1.3;

    proxy_set_header Host api.telegram.org;
    proxy_set_header Connection "";

    proxy_set_header X-Forwarded-For "";
    proxy_set_header X-Real-IP "";
    proxy_set_header True-Client-IP "";
    proxy_set_header CF-Connecting-IP "";
    proxy_set_header X-Client-IP "";
    proxy_set_header Forwarded "";
    proxy_set_header Via "";

    proxy_set_header X-Proxy-Token "";

    proxy_http_version 1.1;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_read_timeout 120s;
    proxy_send_timeout 120s;
}

# --- openrouter Bot API ---
location /openrouter/ {
    if ($allowed_ip = 0) {
        return 403 '{"error":"ip_not_allowed"}';
    }

    set $openrouter_upstream https://openrouter.ai/api/v1;
    rewrite ^/openrouter/(.*) /$1 break;

    proxy_pass $openrouter_upstream;
    proxy_ssl_server_name on;
    proxy_ssl_name openrouter.ai;
    proxy_ssl_protocols TLSv1.2 TLSv1.3;

    proxy_set_header Host openrouter.ai;
    proxy_set_header Connection "";

    proxy_set_header X-Forwarded-For "";
    proxy_set_header X-Real-IP "";
    proxy_set_header True-Client-IP "";
    proxy_set_header CF-Connecting-IP "";
    proxy_set_header X-Client-IP "";
    proxy_set_header Forwarded "";
    proxy_set_header Via "";

    proxy_set_header X-Proxy-Token "";

    proxy_http_version 1.1;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_buffer_size 16k;
    proxy_buffers 4 16k;
    proxy_busy_buffers_size 32k;
    proxy_read_timeout 120s;
    proxy_send_timeout 120s;
}

# --- Catch-all ---
location / {
    default_type application/json;
    return 404 '{"error":"unknown_upstream","hint":"use /elevenlabs/, /openai/ or /telegram/" or /openrouter/}';
}