# The privacy policy (src/pages/datenschutz.astro) promises that no access logs are written.
# Keep access_log off and the error log at "crit" unless that text changes with it.
worker_processes auto;
error_log /dev/stderr crit;
pid /tmp/nginx.pid;

events {
    worker_connections 1024;
}

http {
    client_body_temp_path /tmp/client_temp;
    proxy_temp_path /tmp/proxy_temp;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log off;
    log_not_found off;
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    keepalive_timeout 65;
    charset utf-8;
    charset_types text/css application/javascript image/svg+xml application/xml text/plain;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/css application/javascript image/svg+xml application/xml text/plain application/json;

    server {
        listen 8080;
        server_name _;
        root /usr/share/nginx/html;

        # Relative Location headers, so redirects keep the scheme and host of the reverse proxy.
        absolute_redirect off;

        error_page 404 /404.html;

        include /etc/nginx/security-headers.conf;
        add_header Cache-Control "no-cache" always;

        location /_astro/ {
            include /etc/nginx/security-headers.conf;
            add_header Cache-Control "public, max-age=31536000, immutable" always;
            try_files $uri =404;
        }

        location = /healthz {
            default_type text/plain;
            return 200 "ok\n";
        }

        location / {
            try_files $uri $uri/ =404;
        }
    }
}