# BrevyScribe is a static site: the build produces plain files and the app does
# all its work in the browser, so nginx serves it directly - there is no
# application server, no socket and nothing to proxy to.
#
# Install as /etc/nginx/sites-available/scribe.luxick.de, symlink it into
# sites-enabled, then `nginx -t && systemctl reload nginx`.

server {
	listen 80;
	listen [::]:80;
	server_name scribe.luxick.de;

	# Let certbot answer the challenge, send everything else to HTTPS.
	location /.well-known/acme-challenge/ {
		root /var/www/certbot;
	}
	location / {
		return 301 https://$host$request_uri;
	}
}

server {
	# The `http2 on;` directive only exists from nginx 1.25.1; on older builds
	# (Debian bookworm ships 1.22, Ubuntu 22.04 ships 1.18) it is an unknown
	# directive and the config will not load. This form works everywhere, at the
	# price of a deprecation warning on 1.25.1+.
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name scribe.luxick.de;

	ssl_certificate /etc/letsencrypt/live/scribe.luxick.de/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/scribe.luxick.de/privkey.pem;

	# `certbot certonly` issues the certificate and stops there - unlike the nginx
	# plugin it never writes an `options-ssl-nginx.conf` include, so the protocol
	# and session settings have to live here.
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers off;
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 1d;

	root /var/www/brevyscribe;
	index index.html;

	gzip on;
	gzip_types text/css application/javascript image/svg+xml application/xml;
	gzip_min_length 1024;

	# Vite gives these content-hashed filenames, so they can never go stale.
	location /assets/ {
		expires 1y;
		add_header Cache-Control "public, immutable";
	}

	# The example rosters and the fonts keep their names across builds, so they
	# get a short cache rather than an immutable one.
	location ~* \.(rosz|woff2)$ {
		expires 1h;
		add_header Cache-Control "public";
	}

	# index.html names the hashed assets, so it must never be cached: a stale copy
	# would point at a bundle that no longer exists.
	location = /index.html {
		add_header Cache-Control "no-cache";
	}

	# A single page app with no router, but serving index.html for an unknown path
	# is friendlier than a bare 404.
	location / {
		try_files $uri $uri/ /index.html;
	}
}