server {
    listen 80;
    listen [::]:80;
    server_name p.meson.kr;

    return 301 https://$host$request_uri;
}

server {
    # HTTP/2 over TCP
    listen 443      ssl;
    listen [::]:443 ssl;

    # HTTP/3 over QUIC/UDP
    listen 443      quic;
    listen [::]:443 quic;

    http2 on;
    http3 on;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;

    server_name p.meson.kr;
    root /home/www-data/p.meson.kr;

    include /etc/letsencrypt/options-ssl-nginx.conf;

    ssl_certificate /etc/letsencrypt/live/p.meson.kr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/p.meson.kr/privkey.pem;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # Max upload size (Important if allowing large file attachments in pastes)
    client_max_body_size 32M;

    access_log /var/log/nginx/privatebin_access.log;
    error_log /var/log/nginx/privatebin_error.log;

    location / {
        proxy_pass http://127.0.0.1:6158;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Clear out buffer restrictions for instant file uploads
        proxy_buffering off;
    }

    location ~ /\.(?!well-known) {
    deny all;
    access_log off;
    log_not_found off;
}

location ~* \.(env|log|git|yaml|yml|json)$ {
    deny all;
    access_log off;
    log_not_found off;
}

}