# Grafana monitoring proxy — add inside the `server { listen 80; }` block in apps.conf
# Place BEFORE the generic  location /app/androidcast_project/  block.
#
# Access flow:
#   Browser → FE nginx (TLS) → artc0 BE nginx :80 → cast04:3000 (Grafana)
#   auth_request validates PHP session on each request.
# ─────────────────────────────────────────────────────────────────────────────

    # ── Internal auth_request endpoint (not directly accessible) ────────────
    location = /app/androidcast_project/api/grafana-auth-check.php {
        internal;
        include        fastcgi_params;
        fastcgi_pass   unix:/run/php-fpm.socket;
        fastcgi_param  SCRIPT_FILENAME /var/www/localhost/htdocs/apps/app/androidcast_project/api/grafana-auth-check.php;
        fastcgi_param  SCRIPT_NAME     /app/androidcast_project/api/grafana-auth-check.php;
        fastcgi_param  REQUEST_URI     $request_uri;
        # Forward the original session cookie so the PHP script can read it
        fastcgi_param  HTTP_COOKIE     $http_cookie;
    }

    # ── Redirect bare paths to trailing slash ────────────────────────────────
    location = /app/androidcast_project/monitor {
        return 301 /app/androidcast_project/monitor/;
    }

    location = /app/androidcast_project/alertmanager {
        return 301 /app/androidcast_project/alertmanager/;
    }

    # ── Alertmanager UI at cast04:9093 via auth_request ──────────────────────
    location /app/androidcast_project/alertmanager/ {
        auth_request /app/androidcast_project/api/grafana-auth-check.php;
        auth_request_set $grafana_user $upstream_http_x_webauth_user;
        error_page 401 = @monitor_login_redirect;

        proxy_pass         http://10.7.16.239:9093/;
        proxy_set_header   Host              $http_host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;

        proxy_http_version 1.1;
        proxy_read_timeout 120;
        proxy_send_timeout 120;
    }

    # ── Grafana at cast04:3000 via auth_request ───────────────────────────────
    location /app/androidcast_project/monitor/ {
        # Validate PHP session before allowing through
        auth_request /app/androidcast_project/api/grafana-auth-check.php;

        # Capture username from auth response header and forward to Grafana
        auth_request_set $grafana_user $upstream_http_x_webauth_user;

        # Redirect to login if not authenticated
        error_page 401 = @monitor_login_redirect;

        proxy_pass         http://10.7.16.239:3000/;
        proxy_set_header   Host              $http_host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        # Pass authenticated user to Grafana auth proxy
        proxy_set_header   X-WEBAUTH-USER    $grafana_user;

        proxy_http_version 1.1;
        proxy_read_timeout 300;
        proxy_send_timeout 300;
        # WebSocket support (Grafana live)
        proxy_set_header   Upgrade    $http_upgrade;
        proxy_set_header   Connection $connection_upgrade;
    }

    # ── Login redirect for unauthenticated monitor access ────────────────────
    location @monitor_login_redirect {
        return 302 /app/androidcast_project/login?redirect=$request_uri;
    }