server {
    listen 80;
    server_name _;
    client_max_body_size 100M;

    # Jellyfin
    location / {
        proxy_pass http://127.0.0.1:8096;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_buffering off;
    }

    # Auth subrequest
    location = /_jellyship_auth {
        internal;
        proxy_pass http://127.0.0.1:9199/auth;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Jellyfin-Token $http_x_mediabrowser_token;
        proxy_set_header Authorization $http_authorization;
        proxy_set_header Cookie $http_cookie;
    }

    # JellyShip dashboard (lowercase)
    location /jellyship/ {
        auth_request /_jellyship_auth;
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;
        error_page 401 = @jellyship_login;
        error_page 403 = @jellyship_denied;
        proxy_pass http://127.0.0.1:9821/dashboard/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_buffering off;
    }

    # JellyShip dashboard (capitalized — JS client uses this)
    location /JellyShip/ {
        auth_request /_jellyship_auth;
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;
        error_page 401 = @jellyship_login;
        error_page 403 = @jellyship_denied;
        proxy_pass http://127.0.0.1:9821/dashboard/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_buffering off;
    }

    # JellyShip API (lowercase)
    location /jellyship/api/ {
        auth_request /_jellyship_auth;
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;
        error_page 401 = @jellyship_login;
        error_page 403 = @jellyship_denied;
        proxy_pass http://127.0.0.1:9821/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_buffering off;
    }

    # JellyShip API (capitalized — JS client uses this)
    location /JellyShip/api/ {
        auth_request /_jellyship_auth;
        auth_request_set $auth_cookie $upstream_http_set_cookie;
        add_header Set-Cookie $auth_cookie;
        error_page 401 = @jellyship_login;
        error_page 403 = @jellyship_denied;
        proxy_pass http://127.0.0.1:9821/api/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_buffering off;
    }

    location @jellyship_login {
        add_header WWW-Authenticate 'Basic realm="JellyShip Admin — use Jellyfin credentials"' always;
        return 401;
    }

    location @jellyship_denied {
        default_type text/html;
        return 403 "Admin access required. Log in as Jellyfin administrator.";
    }
}
