map $http_origin $cors_origin {
    "https://rail-switch-dev.web.app" "https://rail-switch-dev.web.app";
    "https://railwai-12d66.web.app" "https://railwai-12d66.web.app";
    "https://railwaidemo.web.app" "https://railwaidemo.web.app";
    "https://ai-rway-switch-project.web.app" "https://ai-rway-switch-project.web.app";
}
server {
    server_name zirak.divertednetworks.net; # Replace with the domain or IP address

    client_max_body_size 500M;
    client_body_timeout 300s;

    location / {
        limit_req zone=mylimit burst=20 nodelay;
        # Adjust the path according to the URL structure
        #proxy_pass https://u407804.your-storagebox.de/ForestVision/ML_out/results/;
        proxy_pass https://u407804.your-storagebox.de/Railwai_Website_Data/;
        proxy_set_header Host u407804.your-storagebox.de;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Automatically include basic auth credentials in the request
        proxy_set_header Authorization "Basic dTQwNzgwNDo3WHFNTm1VajNRU1VZVU1r";

        # Restrict to safe methods
        limit_except GET HEAD {
            deny all;
        }

        # Disable directory listing
        autoindex off;

        add_header Access-Control-Allow-Origin  $cors_origin;
        add_header Access-Control-Allow-Methods "GET, OPTIONS";
        add_header Access-Control-Allow-Headers "Content-Type, Authorization";
        add_header Access-Control-Allow-Credentials true;


        # Optional: Enable Basic Authentication
        #auth_basic "Restricted Access";
        #auth_basic_user_file /etc/nginx/.htpasswd; # Path to the password file
        
        # Add these lines for better timeout handling
        proxy_connect_timeout 300;
        proxy_send_timeout 300;
        proxy_read_timeout 300;
        
        # Add specific location for Potree binary files
        location ~* \.(bin|las|laz)$ {
            proxy_pass https://u407804.your-storagebox.de/Railwai_Website_Data$request_uri;
            proxy_set_header Host u407804.your-storagebox.de;
            proxy_set_header Authorization "Basic dTQwNzgwNDo3WHFNTm1VajNRU1VZVU1r";
            
            # Binary file specific settings
            add_header Content-Type application/octet-stream;
            add_header Accept-Ranges bytes;
            
            # Range request handling
            proxy_set_header Range $http_range;
            proxy_set_header If-Range $http_if_range;
            
            # Buffering settings
            proxy_buffering on;
            proxy_buffer_size 128k;
            proxy_buffers 100 128k;
            
            # Keep-alive and timeout settings
            proxy_http_version 1.1;
            keepalive_timeout 300;
            proxy_read_timeout 300;
            
            # CORS headers specific for Potree
            add_header Access-Control-Allow-Origin $cors_origin always;
            add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Content-Type, Authorization, X-Requested-With, Range" always;
            add_header Access-Control-Expose-Headers "Content-Range, Content-Length" always;
            
            # Error handling
            proxy_intercept_errors on;
            proxy_next_upstream error timeout http_503;
        }
    }


    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/zirak.divertednetworks.net/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/zirak.divertednetworks.net/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = zirak.divertednetworks.net) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    server_name zirak.divertednetworks.net;
    listen 80;
    return 404; # managed by Certbot


}