client_max_body_size 99m;

root __FINALPATH__/live/public;

location / {

  proxy_set_header Accept-Encoding "";
  try_files $uri @proxy;

  # Include SSOWAT user panel.
  include conf.d/yunohost_panel.conf.inc;
}

location ~ /sw.js {
  more_set_headers "Cache-Control: public, max-age=604800, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/assets/ {
  more_set_headers "Cache-Control: public, max-age=2419200, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/avatars/ {
  more_set_headers "Cache-Control: public, max-age=2419200, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/emoji/ {
  more_set_headers "Cache-Control: public, max-age=2419200, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/headers/ {
  more_set_headers "Cache-Control: public, max-age=2419200, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/packs/ {
  more_set_headers "Cache-Control: public, max-age=2419200, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/shortcuts/ {
  more_set_headers "Cache-Control: public, max-age=2419200, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/sounds/ {
  more_set_headers "Cache-Control: public, max-age=2419200, must-revalidate";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  try_files $uri =404;
}

location ~ ^/system/ {
  more_set_headers "Cache-Control: public, max-age=2419200, immutable";
  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";
  more_set_headers "X-Content-Type-Option: nosniff";
  more_set_headers "Content-Security-Policy: default-src 'none'; form-action 'none'";
  try_files $uri =404;
}

location ^~ /api/v1/streaming {
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header Proxy "";

  proxy_pass http://127.0.0.1:__PORT_STREAM__;
  proxy_buffering off;
  proxy_redirect off;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  more_set_headers "Strict-Transport-Security: max-age=63072000; includeSubDomains";

  tcp_nodelay on;
}

location @proxy {
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header Proxy "";
  proxy_pass_header Server;

  proxy_pass http://127.0.0.1:__PORT_WEB__;
  proxy_buffering on;
  proxy_redirect off;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

  proxy_cache CACHE;
  proxy_cache_valid 200 7d;
  proxy_cache_valid 410 24h;
  proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
  more_set_headers "X-Cached: $upstream_cache_status";

  tcp_nodelay on;
}

error_page 500 501 502 503 504 /500.html;