# nginx in front of figcraft-server; setup in docs/server.md ("Deploy on a Linux server").
# Put this in /etc/nginx/conf.d/figcraft.conf (it goes inside nginx's http block), replace the
# host name and the certificate paths (these are certbot's), then `sudo nginx -t` and
# `sudo systemctl reload nginx`.

# WebSocket upgrades: forward the client's Upgrade header and ask for the upgrade only then.
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    server_name figcraft.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name figcraft.example.com;

    ssl_certificate     /etc/letsencrypt/live/figcraft.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/figcraft.example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    # Under a path instead: `location /figcraft/ { ... }` with the same lines, and
    # public_url = "wss://figcraft.example.com/figcraft/".
    location / {
        proxy_pass http://127.0.0.1:47900;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        # Apps ping every 15 seconds and the server drops a connection idle for 45: stay above both.
        proxy_read_timeout 120s;
        proxy_send_timeout 120s;
    }
}