server {
    listen 80;
    listen [::]:80;
    server_name pass.meson.kr;
    return 301 https://$host$request_uri;
}

server {
    # HTTP/2 over TCP
    listen 443      ssl;
    listen [::]:443 ssl;

    # HTTP/3 over QUIC/UDP
    listen 443      quic;
    listen [::]:443 quic;

    http2 on;
    http3 on;

    add_header Alt-Svc 'h3=":443"; ma=86400' always;

    server_name pass.meson.kr;
    root /home/www-data/pass.meson.kr;

    include /etc/letsencrypt/options-ssl-nginx.conf;

    ssl_certificate     /etc/letsencrypt/live/pass.meson.kr/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/pass.meson.kr/privkey.pem;

    access_log /var/log/nginx/pass.meson.kr.log combined if=$loggable;
    error_log  /var/log/nginx/_error_pass.meson.kr.log warn;

    client_max_body_size 525M;   # attachments/sends can be large

    # main app
    location / {
        proxy_pass http://127.0.0.1:8880;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # websocket notifications hub - required for real-time sync between devices
    location /notifications/hub {
        proxy_pass http://127.0.0.1:8880;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /notifications/hub/negotiate {
        proxy_pass http://127.0.0.1:8880;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # lock down /admin to your Tailscale/LAN range - drop this block entirely
    # once initial setup is done and you disable ADMIN_TOKEN instead
    location /admin {
        allow 100.64.0.0/10;   # example: Tailscale CGNAT range
        allow 127.0.0.1;
        deny all;
        proxy_pass http://127.0.0.1:8880;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}