# =============================================================================
# Poptonium companion backend, SWAG / nginx snippet
#
# Paste these two `location` blocks INSIDE the `server { ... }` block of your
# existing Plex reverse-proxy conf (e.g. plex.subdomain.conf), ABOVE the main
# `location / { ... }` Plex block.
#
# It exposes the Poptonium API at  https://<your-plex-domain>/poptonium  so the
# Poptonium app can auto-discover it from the Plex server connection, with no
# extra domain or DNS record. The app mounts its routes under /poptonium, so we
# proxy_pass WITHOUT a trailing URI to preserve the path (no rewrite).
#
# Requirements:
#   - The Poptonium container is named `poptonium` and on the same docker
#     network as SWAG (set `$upstream_app` to the container name or host IP).
#   - Poptonium listens on port 8085 inside the container.
#
# The admin dashboard (and its auth/config endpoints) carry their own login, but
# we ALSO keep them off the public internet: the regex `location` below is
# matched before the `/poptonium/` prefix block and returns 404 unless the
# request comes from the LAN. The app never calls /admin, so the API is
# unaffected; admin stays reachable on the LAN or directly at host:8085/admin.
#
# `$lan-ip` is a SWAG-specific variable (the geo of the client IP, RFC1918 = yes,
# defined in /config/nginx/dbip.conf). It does NOT exist in plain nginx or other
# proxies. If your setup lacks it, replace the `if` line with an allow/deny list
# of your LAN ranges, for example:
#     allow 192.168.0.0/16; allow 10.0.0.0/8; deny all;
# =============================================================================

# Admin dashboard + auth/config endpoints: LAN-only (matched before the API block).
location ~ ^/poptonium/admin(/|$) {
    if ($lan-ip != yes) { return 404; }
    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;
    set $upstream_app poptonium;
    set $upstream_port 8085;
    set $upstream_proto http;
    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}

# Public API (sections, ratings, capabilities, popular, overseerr, opensubtitles,
# subtitle-prefs, the Plex proxy). Reachable wherever the app is.
location /poptonium/ {
    include /config/nginx/proxy.conf;
    include /config/nginx/resolver.conf;
    set $upstream_app poptonium;
    set $upstream_port 8085;
    set $upstream_proto http;
    proxy_pass $upstream_proto://$upstream_app:$upstream_port;
}