server {
    listen 8442 ssl default_server;
    listen [::]:8442 ssl default_server;
    server_name _;
    ssl_certificate /etc/nginx/caiwu-jiansuntuzhi-fullchain.pem;
    ssl_certificate_key /etc/nginx/caiwu-jiansuntuzhi.key;
    ssl_session_cache shared:CAIWU_DOMAIN_SSL:2m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    client_max_body_size 64m;

    # The legacy registered HTTP callback must reach the browser's canonical
    # HTTPS origin before Laravel reads its session. Proxying it with a forged
    # Host loses the domain cookie and defeats browser-bound OAuth state.
    error_page 497 = @plain_http_request;

    location @plain_http_request {
        add_header Cache-Control "no-store" always;
        add_header Referrer-Policy "no-referrer" always;
        return 302 https://caiwu.jiansuntuzhi.cn:8442$request_uri;
    }

    location / {
        return 308 https://caiwu.jiansuntuzhi.cn:8442$request_uri;
    }
}

server {
    listen 8442 ssl;
    listen [::]:8442 ssl;
    server_name caiwu.jiansuntuzhi.cn;
    ssl_certificate /etc/nginx/caiwu-jiansuntuzhi-fullchain.pem;
    ssl_certificate_key /etc/nginx/caiwu-jiansuntuzhi.key;
    ssl_session_cache shared:CAIWU_DOMAIN_SSL:2m;
    ssl_session_timeout 10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    client_max_body_size 64m;
    location / {
        proxy_pass http://127.0.0.1:18088;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port 8442;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 120s;
    }
}