# based on https://github.com/misskey-dev/misskey-hub/blob/7071f63a1c80ee35c71f0fd8a6d8722c118c7574/src/docs/admin/nginx.md

# For WebSocket
map $http_upgrade $connection_upgrade {
	default upgrade;
	'' close;
}

proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=cache1:16m max_size=1g inactive=720m use_temp_path=off;

server {
	listen 80;
	listen [::]:80;
	server_name ${HOST};

	# For SSL domain validation
	root /var/www/html;
	location /.well-known/acme-challenge/ { allow all; }
	location /.well-known/pki-validation/ { allow all; }
	location / { return 301 https://$server_name$request_uri; }
}

server {
	listen 443 ssl;
	listen [::]:443 ssl;
	http2 on;
	server_name ${HOST};

	ssl_session_timeout 1d;
	ssl_session_cache shared:ssl_session_cache:10m;
	ssl_session_tickets off;

	ssl_trusted_certificate /etc/nginx/certificates/rootCA.crt;
	ssl_certificate /etc/nginx/certificates/$server_name.crt;
	ssl_certificate_key /etc/nginx/certificates/$server_name.key;

	# SSL protocol settings
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_prefer_server_ciphers off;
	ssl_stapling on;
	ssl_stapling_verify on;

	# Change to your upload limit
	client_max_body_size 80m;

	# Proxy to Node
	location / {
		proxy_pass http://misskey.${HOST}:3000;
		proxy_set_header Host $host;
		proxy_http_version 1.1;
		proxy_redirect off;

		# If it's behind another reverse proxy or CDN, remove the following.
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto https;

		# For WebSocket
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;

		# Cache settings
		proxy_cache cache1;
		proxy_cache_lock on;
		proxy_cache_use_stale updating;
		proxy_force_ranges on;
		add_header X-Cache $upstream_cache_status;
	}
}