server {
    listen 80;
    listen [::]:80;
    server_name code.meson.kr;

    return 301 https://$host$request_uri;
}

server {
    # HTTP/2 over TCP
    listen 443      ssl;
    listen [::]:443 ssl;

    # HTTP/3 over QUIC/UDP
    listen 443      quic;
    listen [::]:443 quic;

    http2 on;
    http3 on;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;

    server_name code.meson.kr;
    root /home/www-data/code.meson.kr;

    # SSL Certificate Configuration (Certbot managed)

    include /etc/letsencrypt/options-ssl-nginx.conf;

    ssl_certificate /etc/letsencrypt/live/code.meson.kr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/code.meson.kr/privkey.pem;

    # Security Headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # Max upload size (Crucial for pasting large codebases or file drag-and-drops)
    client_max_body_size 64M;

    # Logging
    access_log /var/log/nginx/p.onni.me.log combined if=$loggable;
    error_log  /var/log/nginx/_error_p.onni.me.log warn;

    location / {
        # Forward traffic to the Docker container port we mapped
        proxy_pass http://127.0.0.1:6157;

        # Standard Reverse Proxy Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket Support (Required for Opengist interactive features)
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Proxy Timeout Optimizations
        proxy_connect_timeout 90s;
        proxy_send_timeout 90s;
        proxy_read_timeout 90s;
        proxy_buffering off;
    }
}