# Do not enable this file until DNS, origin certificates, and private upstream
# checks are complete. Adapt certificate/include paths to the VPS conventions.

server {
    listen 80;
    listen [::]:80;
    server_name laikapstak.li auth.laikapstak.li;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name auth.laikapstak.li;

    ssl_certificate /etc/nginx/tls/laikapstak.li/origin.pem;
    ssl_certificate_key /etc/nginx/tls/laikapstak.li/origin.key;

    location / {
        include /etc/nginx/snippets/weathertool-proxy.conf;
        proxy_pass http://127.0.0.1:9091;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name laikapstak.li;

    ssl_certificate /etc/nginx/tls/laikapstak.li/origin.pem;
    ssl_certificate_key /etc/nginx/tls/laikapstak.li/origin.key;

    # Start short during UAT. Increase only after TLS behavior is proven.
    add_header Strict-Transport-Security "max-age=3600" always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy no-referrer always;

    include /etc/nginx/snippets/weathertool-authelia-location.conf;

    location /api/ {
        include /etc/nginx/snippets/weathertool-proxy.conf;
        include /etc/nginx/snippets/weathertool-authelia-api-authrequest.conf;
        proxy_pass http://127.0.0.1:8002;
    }

    location / {
        include /etc/nginx/snippets/weathertool-proxy.conf;
        include /etc/nginx/snippets/weathertool-authelia-authrequest.conf;
        proxy_pass http://127.0.0.1:8002;
    }
}