user www-data;
worker_processes 1;
pid /run/reelbox-web/nginx.pid;
error_log /var/log/reelbox/error.log warn;
events { worker_connections 256; }
http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    client_body_temp_path /run/reelbox-web/client_temp;
    proxy_temp_path /run/reelbox-web/proxy_temp;
    fastcgi_temp_path /run/reelbox-web/fastcgi_temp;
    uwsgi_temp_path /run/reelbox-web/uwsgi_temp;
    scgi_temp_path /run/reelbox-web/scgi_temp;
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    keepalive_timeout 30;
    client_max_body_size 1k;
    access_log off;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache shared:ReelboxTLS:1m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;
    server {
        # Verify ownership/firewall rules on a new host before enabling 443.
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        # Keep the legacy listener available for previously released clients.
        listen 8443 ssl http2;
        listen [::]:8443 ssl http2;
        server_name reelbox.dartty.top;
        ssl_certificate /etc/letsencrypt/live/reelbox.dartty.top/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/reelbox.dartty.top/privkey.pem;
        include /etc/reelbox/api-locations.conf;
        root /var/www/reelbox/current;
        index index.html;
        include /etc/reelbox/security-headers.conf;
        location / {
            limit_except GET { deny all; }
            try_files $uri $uri/ =404;
        }
        location /downloads/ {
            limit_except GET { deny all; }
            types {
                application/vnd.android.package-archive apk;
                application/zip zip;
                text/plain txt;
            }
            autoindex off;
            max_ranges 1;
            try_files $uri =404;
            include /etc/reelbox/security-headers.conf;
            add_header Content-Disposition "attachment";
        }
        location ~ /\. { return 404; }
    }
}