// TLS reverse proxy: terminate integrate.api.nvidia.com locally,
// forward to Cloudflare Worker
import https from 'node:https';
import http from 'node:http';
import fs from 'node:fs';
import { URL } from 'node:url';

const CERT_PATH = process.env.NV_TLS_CERT || '/tmp/nvidia-proxy-cert.pem';
const KEY_PATH  = process.env.NV_TLS_KEY  || '/tmp/nvidia-proxy-key.pem';
const TARGET    = process.env.NV_TLS_TARGET || 'https://ayoub5550-nvidia-proxy.ayoubteke11.workers.dev';
const PORT      = parseInt(process.env.NV_TLS_PORT || '443');

const targetUrl = new URL(TARGET);

const server = https.createServer({
  cert: fs.readFileSync(CERT_PATH),
  key: fs.readFileSync(KEY_PATH),
}, (req, res) => {
  const options = {
    hostname: targetUrl.hostname,
    port: 443,
    path: req.url,
    method: req.method,
    headers: {
      ...req.headers,
      host: targetUrl.hostname,  // Override Host header
    },
  };
  
  // Remove hop-by-hop headers
  delete options.headers['connection'];
  delete options.headers['transfer-encoding'];
  
  const proxyReq = https.request(options, (proxyRes) => {
    res.writeHead(proxyRes.statusCode, proxyRes.headers);
    proxyRes.pipe(res);
  });
  
  proxyReq.on('error', (err) => {
    console.error(`[nvidia-tls-proxy] error: ${err.message}`);
    if (!res.headersSent) {
      res.writeHead(502, {'Content-Type': 'text/plain'});
    }
    res.end(`Proxy error: ${err.message}`);
  });
  
  req.pipe(proxyReq);
});

server.listen(PORT, '127.0.0.1', () => {
  console.log(`[nvidia-tls-proxy] listening on https://127.0.0.1:${PORT} -> ${TARGET}`);
});