# Authentik SSO & Identity Provider
resource "nginxproxymanager_proxy_host" "auth" {
  domain_names            = ["auth.${var.domain}"]
  forward_host            = "authentik-server"
  forward_port            = 9000
  forward_scheme          = "http"
  enabled                 = true
  block_exploits          = true
  allow_websocket_upgrade = true
}

# Central Dashboard
resource "nginxproxymanager_proxy_host" "dashboard" {
  domain_names            = ["dashboard.${var.domain}"]
  forward_host            = "homepage"
  forward_port            = 3000
  forward_scheme          = "http"
  enabled                 = true
  block_exploits          = true
  allow_websocket_upgrade = true
}

# Nextcloud Cloud & Office
resource "nginxproxymanager_proxy_host" "cloud" {
  domain_names            = ["cloud.${var.domain}"]
  forward_host            = "nextcloud"
  forward_port            = 80
  forward_scheme          = "http"
  enabled                 = true
  block_exploits          = true
  allow_websocket_upgrade = true
}

resource "nginxproxymanager_proxy_host" "office" {
  domain_names            = ["office.${var.domain}"]
  forward_host            = "collabora"
  forward_port            = 9980
  forward_scheme          = "http"
  enabled                 = true
  allow_websocket_upgrade = true
}

# SimpleLogin Mail Aliases
resource "nginxproxymanager_proxy_host" "mail" {
  domain_names            = ["mail.${var.domain}"]
  forward_host            = "simplelogin-app"
  forward_port            = 80
  forward_scheme          = "http"
  enabled                 = true
  allow_websocket_upgrade = true
}

# Forgejo Git & CI/CD
resource "nginxproxymanager_proxy_host" "git" {
  domain_names            = ["git.${var.domain}"]
  forward_host            = "forgejo"
  forward_port            = 3000
  forward_scheme          = "http"
  enabled                 = true
  block_exploits          = true
  allow_websocket_upgrade = true
}

# Plane Task Management
resource "nginxproxymanager_proxy_host" "tasks" {
  domain_names            = ["tasks.${var.domain}"]
  forward_host            = "plane-web"
  forward_port            = 3000
  forward_scheme          = "http"
  enabled                 = true
  allow_websocket_upgrade = true
}

resource "nginxproxymanager_proxy_host" "wiki" {
  domain_names            = ["wiki.${var.domain}"]
  forward_host            = "docmost"
  forward_port            = 3000
  forward_scheme          = "http"
  enabled                 = true
  allow_websocket_upgrade = true
}

# Paperless-ngx Document Repository
resource "nginxproxymanager_proxy_host" "docs" {
  domain_names            = ["docs.${var.domain}"]
  forward_host            = "paperless-webserver"
  forward_port            = 8000
  forward_scheme          = "http"
  enabled                 = true
  block_exploits          = true
  allow_websocket_upgrade = true
}

# Calibre-Web E-Book Library
resource "nginxproxymanager_proxy_host" "books" {
  domain_names            = ["books.${var.domain}"]
  forward_host            = "calibre-web"
  forward_port            = 8083
  forward_scheme          = "http"
  enabled                 = true
  allow_websocket_upgrade = true
}

# Uptime Kuma Monitoring
resource "nginxproxymanager_proxy_host" "status" {
  domain_names            = ["status.${var.domain}"]
  forward_host            = "uptime-kuma"
  forward_port            = 3001
  forward_scheme          = "http"
  enabled                 = true
  allow_websocket_upgrade = true
}