<?xml version="1.0" encoding="UTF-8"?>
<!--
  IIS reverse proxy + HTTPS-only enforcement for DPOT-Front.
  Deploy location: F:\IIS\DPOT\Front\web.config (kept across Jenkins deploys via keep[]).
  Requires:
    - IIS URL Rewrite module
    - Application Request Routing (ARR) with Proxy enabled (Server-level)
    - Cloudflare in front (sets CF-Connecting-IP)
-->
<configuration>
  <system.webServer>
    <httpErrors existingResponse="PassThrough" errorMode="Detailed"/>

    <rewrite>
      <rules>
        <!-- 1) HTTP -> HTTPS 301 redirect -->
        <rule name="HTTP_to_HTTPS" stopProcessing="true">
          <match url="(.*)"/>
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$"/>
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent"/>
        </rule>

        <!-- 2) Reverse proxy to Next.js (port 3000) -->
        <rule name="ReverseProxyToNode" stopProcessing="true">
          <match url="(.*)"/>
          <action type="Rewrite" url="http://127.0.0.1:3000/{R:1}"/>
          <serverVariables>
            <set name="HTTP_X_FORWARDED_PROTO" value="https"/>
            <set name="HTTP_X_FORWARDED_HOST" value="{HTTP_HOST}"/>
            <set name="HTTP_X_FORWARDED_PORT" value="443"/>
            <set name="HTTP_X_FORWARDED_FOR" value="{HTTP_CF_CONNECTING_IP}"/>
            <set name="HTTP_X_REAL_IP" value="{HTTP_CF_CONNECTING_IP}"/>
          </serverVariables>
        </rule>
      </rules>
    </rewrite>

    <security>
      <ipSecurity allowUnlisted="false">
        <!-- Cloudflare IPv4 -->
        <add ipAddress="103.21.244.0"  subnetMask="255.255.252.0"   allowed="true"/>
        <add ipAddress="103.22.200.0"  subnetMask="255.255.252.0"   allowed="true"/>
        <add ipAddress="103.31.4.0"    subnetMask="255.255.252.0"   allowed="true"/>
        <add ipAddress="104.16.0.0"    subnetMask="255.248.0.0"     allowed="true"/>
        <add ipAddress="104.24.0.0"    subnetMask="255.252.0.0"     allowed="true"/>
        <add ipAddress="108.162.192.0" subnetMask="255.255.192.0"   allowed="true"/>
        <add ipAddress="131.0.72.0"    subnetMask="255.255.252.0"   allowed="true"/>
        <add ipAddress="141.101.64.0"  subnetMask="255.255.192.0"   allowed="true"/>
        <add ipAddress="162.158.0.0"   subnetMask="255.254.0.0"     allowed="true"/>
        <add ipAddress="172.64.0.0"    subnetMask="255.248.0.0"     allowed="true"/>
        <add ipAddress="173.245.48.0"  subnetMask="255.255.240.0"   allowed="true"/>
        <add ipAddress="188.114.96.0"  subnetMask="255.255.240.0"   allowed="true"/>
        <add ipAddress="190.93.240.0"  subnetMask="255.255.240.0"   allowed="true"/>
        <add ipAddress="197.234.240.0" subnetMask="255.255.252.0"   allowed="true"/>
        <add ipAddress="198.41.128.0"  subnetMask="255.255.128.0"   allowed="true"/>
        <!-- Internal -->
        <add ipAddress="10.10.0.0"     subnetMask="255.255.255.0"   allowed="true"/>
        <add ipAddress="192.168.0.0"   subnetMask="255.255.255.0"   allowed="true"/>
        <add ipAddress="127.0.0.1"     allowed="true"/>
      </ipSecurity>
    </security>
  </system.webServer>
</configuration>
