#!/bin/bash
echo "=== S204 ROOT FIX ALL ==="

# 1. Cleanup nginx .bak files
echo "[1] Cleaning nginx .bak files..."
rm -f /etc/nginx/sites-enabled/*.bak-*
echo "CLEANED"

# 2. Add /arsenal-proxy/ nginx location (proxy to S95)
CONF="/etc/nginx/sites-enabled/weval-consulting"
if ! grep -q "arsenal-proxy" "$CONF"; then
    # Insert before last closing brace of HTTPS server block
    sed -i '/location ~\* \\\.\(js\|css\|png\)/i\
    # Arsenal proxy to S95\
    location /arsenal-proxy/ {\
        proxy_pass http://10.1.0.3:5890/;\
        proxy_http_version 1.1;\
        proxy_set_header Host $host;\
        proxy_set_header X-Real-IP $remote_addr;\
        proxy_read_timeout 60s;\
    }' "$CONF"
    echo "ARSENAL_PROXY_ADDED"
else
    echo "ARSENAL_PROXY_EXISTS"
fi

# 3. Test + reload nginx
nginx -t 2>&1 && systemctl reload nginx && echo "NGINX_RELOADED" || echo "NGINX_FAIL"

echo "=== DONE ==="