# /etc/nginx/sites-enabled/chi.meson.one
#
# Static HTML5 site — chi.meson.one
# Requires: /etc/nginx/conf.d/log-maps.conf ($loggable, log_format static)
server {
    listen      80      default_server;
    listen      [::]:80 default_server;
    server_name chi.meson.one;
    server_tokens off;
    access_log  off;
    return 301  https://$host$request_uri;
}
server {
    # HTTP/2 over TCP
    listen 443          ssl default_server;
    listen [::]:443     ssl default_server;
    # HTTP/3 over QUIC/UDP
    listen 443          quic ;
    listen [::]:443     quic ;
    http2 on;
    http3 on;
    add_header Alt-Svc 'h3=":443"; ma=86400' always;
    server_name chi.meson.one;
    server_tokens off;
    root        /var/www/chi.meson.one;
    index       index.html;
    access_log  /var/log/nginx/chi.meson.one.log      json buffer=32k flush=5m if=$loggable;
    error_log   /var/log/nginx/_error_chi.meson.one.log warn;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_certificate         /etc/letsencrypt/live/chi.meson.one/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/chi.meson.one/privkey.pem;
    ssl_dhparam             /etc/letsencrypt/dh/chi.pem;
    # Security headers
    add_header Strict-Transport-Security    "max-age=63072000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options       "nosniff"       always;
    add_header X-Frame-Options              "SAMEORIGIN"    always;
    add_header X-XSS-Protection             "1; mode=block" always;
    add_header Referrer-Policy              "no-referrer-when-downgrade" always;
    add_header Permissions-Policy           "interest-cohort=()" always;
    # Gzip
    gzip            on;
    gzip_vary       on;
    gzip_static     on;
    gzip_comp_level 4;
    gzip_min_length 1000;
    gzip_types
        text/plain text/css text/xml text/javascript
        application/json application/javascript application/xml
        image/svg+xml;
    error_page 404 /404.html;
    error_page 401 /401.html;
    # Static files
    location / {
        try_files $uri $uri/ =404;
    }
    # Long-lived cache for versioned assets.
    # Repeats security headers — child add_header replaces parent's entirely.
    location ~* \.(ico|css|js|gif|jpe?g|png|webp|svg|woff2?|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control                "public, immutable";
        add_header Strict-Transport-Security    "max-age=63072000; includeSubDomains; preload" always;
        add_header X-Content-Type-Options       "nosniff"       always;
        add_header X-Frame-Options              "SAMEORIGIN"    always;
        add_header X-XSS-Protection             "1; mode=block" always;
        add_header Referrer-Policy              "no-referrer-when-downgrade" always;
        add_header Permissions-Policy           "interest-cohort=()" always;
        access_log      off;
        log_not_found   off;
    }
    # Block hidden files
    location ~ /\. {
        deny all;
        access_log    off;
        log_not_found off;
    }
}