root __INSTALL_DIR__/front/dist;

location /api/ {

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  # this is needed if you have file import via upload enabled
  client_max_body_size 100M;
  proxy_pass   http://127.0.0.1:__PORT__;
}

location / {
  alias __INSTALL_DIR__/front/dist/;
  expires 1d;
  try_files $uri $uri/  /index.html;
}

location /embed.html {
  more_set_headers "Content-Security-Policy: connect-src https: http: 'self'; default-src 'self'; script-src 'self' unpkg.com 'unsafe-inline' 'unsafe-eval'; style-src https: http: 'self' 'unsafe-inline'; img-src https: http: 'self' data:; font-src https: http: 'self' data:; object-src 'none'; media-src https: http: 'self' data:";
  more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";

  alias __INSTALL_DIR__/front/dist/embed.html;
  expires 1d;
}

location /federation/ {

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  proxy_pass   http://127.0.0.1:__PORT__/federation/;
}

# You can comment this if you do not plan to use the Subsonic API
location /rest/ {

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  proxy_pass   http://127.0.0.1:__PORT__/api/subsonic/rest/;
}

location /.well-known/ {

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  proxy_pass   http://127.0.0.1:__PORT__;
}

location /media/__sized__/ {
  alias __DATA_DIR__/data/media/__sized__/;
  more_set_headers "Access-Control-Allow-Origin: *";
}

location /media/attachments/ {
  alias __DATA_DIR__/data/media/attachments/;
  more_set_headers "Access-Control-Allow-Origin: *";
}

# This is an internal location that is used to serve
# media (uploaded) files once correct permission / authentication
# has been checked on API side.
# Comment the "NON-S3" commented lines and uncomment "S3" commented lines
# if you're storing media files in a S3 bucket.
location ~ /_protected/media/(.+) {
  internal;
  alias  __DATA_DIR__/data/media/$1/;                                 # NON-S3
# Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932.
# proxy_set_header Authorization "";                                  # S3
# proxy_pass $1;                                                      # S3
  more_set_headers "Access-Control-Allow-Origin: *";
    }

location /_protected/music/ {
  # this is an internal location that is used to serve
  # audio files once correct permission / authentication
  # has been checked on API side
  # Set this to the same value as your MUSIC_DIRECTORY_PATH setting
  internal;
  alias   __DATA_DIR__/data/music/;
  more_set_headers "Access-Control-Allow-Origin: *";
}

# Allow direct access to /staticfiles
location /staticfiles/ {
  alias __DATA_DIR__/data/static/;
  more_set_headers "Access-Control-Allow-Origin: *";
}

# Allow direct access to only specific subdirectories in /media
location /media/dynamic_preferences/ {
  alias __DATA_DIR__/data/media/dynamic_preferences/;
  more_set_headers "Access-Control-Allow-Origin: *";
}

location /manifest.json {
  return 302 /api/v1/instance/spa-manifest.json;
}