root __FINALPATH__/front/dist;

location / {

  # Force usage of https
  if ($scheme = http) {
    rewrite ^ https://$server_name$request_uri? permanent;
  }

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  # this is needed if you have file import via upload enabled
  client_max_body_size 100M;
  proxy_pass   http://127.0.0.1:__PORT__/;

  # Include SSOWAT user panel.
  include conf.d/yunohost_panel.conf.inc;
}

location /front/ {
  more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
  more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";
  more_set_headers "Service-Worker-Allowed: /";
  more_set_headers "X-Frame-Options: SAMEORIGIN";
  alias __FINALPATH__/front/dist/;
  expires 30d;
  more_set_headers "Pragma: public";
  more_set_headers "Cache-Control: public, must-revalidate, proxy-revalidate";
}

location /front/embed.html {
  more_set_headers "Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:";
  more_set_headers "Referrer-Policy: strict-origin-when-cross-origin";

  more_set_headers "X-Frame-Options: ALLOW";
  alias __FINALPATH__/front/dist/embed.html;
  expires 30d;
  more_set_headers "Pragma: public";
  more_set_headers "Cache-Control: public, must-revalidate, proxy-revalidate";
}

location /federation/ {

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  proxy_pass   http://127.0.0.1:__PORT__/federation/;
}

# You can comment this if you do not plan to use the Subsonic API
location /rest/ {

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  proxy_pass   http://127.0.0.1:__PORT__/api/subsonic/rest/;
}

location /.well-known/ {

  # global proxy conf
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Port $server_port;
  proxy_redirect off;

  # websocket support
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  proxy_pass   http://127.0.0.1:__PORT__/.well-known/;
}

location /media/ {
  alias __DATADIR__/media/;
}

location /_protected/media {
  # this is an internal location that is used to serve
  # audio files once correct permission / authentication
  # has been checked on API side
  internal;
  alias   __DATADIR__/media;
}

# Comment the previous location and uncomment this one if you're storing
# media files in a S3 bucket
# location ~ /_protected/media/(.+) {
#   internal;
#   # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932
#   proxy_set_header Authorization "";
#   proxy_pass $1;
# }

location /_protected/music {
  # this is an internal location that is used to serve
  # audio files once correct permission / authentication
  # has been checked on API side
  # Set this to the same value as your MUSIC_DIRECTORY_PATH setting
  internal;
  alias   __DATADIR__/music;
}

location /staticfiles/ {
  # django static files
  alias __DATADIR__/static/;
}