#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;

#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
    listen 443 ssl;
    http2 on;
    gzip on;

    server_name host.domain.com;
    server_tokens off;

    ssl_certificate C:/ca/star_domain_com.crt;
    ssl_certificate_key C:/ca/star_domain_com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers on;
    ssl_session_tickets off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;
    ssl_buffer_size 8k;
    ssl_stapling on;
    ssl_stapling_verify on;

    add_header X-Content-Type-Options nosniff;
    add_header Content-Security-Policy "frame-ancestors 'self'; ";
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    # Proxy settings for static files
    location /swagger {
        alias C:/SignageCMS3/Server/swagger;
    }
    location /js {
        alias C:/SignageCMS3/Server/frontend/js;
    }
    location /img {
        alias C:/SignageCMS3/Server/frontend/img;
    }
    location /fonts {
        alias C:/SignageCMS3/Server/frontend/fonts;
    }
    location /css {
        alias C:/SignageCMS3/Server/frontend/css;
    }
    location /html_addon {
        alias C:/SignageCMS3/Server/frontend/html_addon;
    }
    location /assets {
        alias C:/SignageCMS3/Server/webplayer/assets;
    }
    # Proxy settings for media files
    location /public {
        alias C:/SignageCMS3Data/Server/public;
    }
    # Proxy settings for MQTT service
    location /mqtt {
        proxy_pass http://127.0.0.1:1883;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
    # Proxy settings for web service
    location / {
        proxy_pass http://127.0.0.1:8000;

        proxy_http_version 1.1;
        proxy_set_header Connection "";

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # client_max_body_size 100M;  # Upload size limitation
    }
}