# Inferencium - xb-00-01
# Nginx - Configuration - Website
# Version: 10.0.0-alpha.9

# Copyright 2022 Jake Winters
# SPDX-License-Identifier: BSD-3-Clause


# Server (unencrypted)
## Redirect from this server block to an encrypted server block if TLS is required
server {
		# General
		server_name								inferencium.net www.inferencium.net;
		## IPv4
		listen									80;
		## IPv6
		listen									[::]:80;

		# Location
		location / {
				return							301 https://$server_name$request_uri;
		}
}


# Server (TLS)
server {
		# General
		server_name								inferencium.net;
		## IPv4
		listen									443 ssl http2;
		## IPv6
		listen									[::]:443 ssl http2;

		# Location
		location / {
				root							/srv/www/inferencium;
				index							index.xhtml;
				try_files						$uri.xhtml $uri $uri/ =404;
				rewrite							^(/.*)\.xhtml(\?.*)?$ $1$2 permanent;
				rewrite							^/(.*)/$ /$1 permanent;
		}

		# Security
		ssl_trusted_certificate					/etc/letsencrypt/live/inferencium.net/chain.pem;
		ssl_certificate							/etc/letsencrypt/live/inferencium.net/fullchain.pem;
		ssl_certificate_key						/etc/letsencrypt/live/inferencium.net/privkey.pem;
		ssl_protocols							TLSv1.3;
		ssl_ciphers								"ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256";
		ssl_conf_command Ciphersuites			"TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256";
		ssl_conf_command Options				PrioritizeChaCha;
		ssl_prefer_server_ciphers				on;
		ssl_ecdh_curve							X25519;
		ssl_stapling							on;
		ssl_stapling_verify						on;
		ssl_session_timeout						1d;
		ssl_session_cache						shared:MozSSL:10m;
		ssl_session_cache						shared:ssl_session_cache:10m;
		ssl_session_tickets						off;

		## Headers
		include									/etc/nginx/include/header-security.conf;
		
		client_max_body_size					16m;
		ignore_invalid_headers					off;

		proxy_http_version						1.1;
		proxy_set_header Upgrade				$http_upgrade;
		proxy_set_header Connection				"upgrade";
		proxy_set_header Host					$http_host;
		proxy_set_header X-Forwarded-For		$proxy_add_x_forwarded_for;
}