server {
    if ($host = tau.meson.one) {
        return 301 https://$host$request_uri;
    }                                           # managed by Certbot

        listen 80 default_server;
        listen [::]:80 default_server;
        server_name tau.meson.one;
        return 301 https://$server_name$request_uri;

        access_log      /var/log/nginx/tau.meson.one.log    combined if=$loggable;
        error_log       /var/log/nginx/_error_tau.meson.one.log   warn;

}

server {
    # HTTP/2 over TCP
    listen 443      ssl default_server;
    listen [::]:443 ssl default_server;

    # HTTP/3 over QUIC/UDP
    listen 443      quic;
    listen [::]:443 quic;

    http2 on;
    http3 on;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;

        server_name     tau.meson.one; 
        root            /var/www/tau.meson.one; 
        index           index.html;

        access_log      /var/log/nginx/tau.meson.one.log    combined if=$loggable;
        error_log       /var/log/nginx/_error_tau.meson.one.log   warn;

        error_page 404  /notfound.html;
        error_page 401  /notauthorized.html;

        include /etc/letsencrypt/options-ssl-nginx.conf;

        client_max_body_size    0;
        proxy_read_timeout      300;  # answer from server, 5 min
        proxy_send_timeout      300;  # chunks to server, 5 min
        proxy_set_header        Host $host;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;
        port_in_redirect        off;
        ssl_certificate         /etc/letsencrypt/live/tau.meson.one/fullchain.pem;       # managed by Certbot
        ssl_certificate_key     /etc/letsencrypt/live/tau.meson.one/privkey.pem;         # managed by Certbot
        ssl_dhparam             /etc/letsencrypt/dh/tau.pem;

        # Add headers to serve security related headers
        add_header      Strict-Transport-Security "max-age=63072000" always;
        add_header      X-Content-Type-Options nosniff;
        add_header      X-Frame-Options "SAMEORIGIN";
        add_header      X-XSS-Protection "1; mode=block";
        add_header      X-Robots-Tag none;
        add_header      X-Download-Options noopen;
        add_header      X-Permitted-Cross-Domain-Policies none;
        add_header      Referrer-Policy "strict-origin";
        add_header      Feature-Policy "geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;";
#       add_header      Content-Security-Policy "default-src 'self' www.google-analytics.com ajax.googleapis.com www.google.com google.com gstatic.com www.gstatic.com connect.facebook.net facebook.com;";

        #        ssl_stapling            on;
        #        ssl_stapling_verify     on;

        ssl_trusted_certificate /etc/letsencrypt/live/tau.meson.one/chain.pem;
        resolver              1.1.1.1 1.0.0.1 8.8.8.8 8.8.4.4 valid=300s;
        resolver_timeout      5s;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    # config.php and data/ never need to be served directly.
    # These MUST come before the ~ \.php$ block below — nginx picks the
    # first matching regex location by order-in-file, not by specificity,
    # so if the generic .php block came first it would win and serve
    # config.php straight through PHP-FPM (returns 200, not 403/404).
    location = /config.php {
        deny all;
    }

    location ^~ /data/ {
        deny all;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

}