user ubuntu;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # HTTP to HTTPS redirect
    server {
        listen 80;
        server_name khaeroen-bot.sanbersy.com;
        return 301 https://$host$request_uri;
    }

    # HTTPS server
    server {
        listen 443 ssl;
        server_name khaeroen-bot.sanbersy.com;

        ssl_certificate /etc/letsencrypt/live/khaeroen-bot.sanbersy.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/khaeroen-bot.sanbersy.com/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

        root /home/ubuntu/.openclaw/workspace;
        index index.html index.htm;

        # Let's Encrypt ACME challenge
        location /.well-known/acme-challenge/ {
            root /var/www/html;
            allow all;
        }

        # Root path - lists workspace directory
        location / {
            autoindex on;
            try_files $uri $uri/ =404;
        }

        # /demo route
        location /demo/ {
            alias /home/ubuntu/.openclaw/workspace/demo/;
            try_files $uri $uri/ =404;
        }

        # /workspace route - workspace access
        location /workspace/ {
            alias /home/ubuntu/.openclaw/workspace/;
            autoindex on;
        }
    }
}
