upstream lisglosips_api {
    server 127.0.0.1:3000 max_fails=3 fail_timeout=5s;
    keepalive 32;
}

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 308 https://$host$request_uri;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name _;

    include /etc/nginx/snippets/lisglosips-tls.conf;

    root /opt/lisglosips/current/public;
    index index.html;
    client_max_body_size 2m;
    max_ranges 1;

    include /etc/nginx/snippets/lisglosips-security-headers.conf;

    limit_conn lisglosips_conn_per_ip 30;

    location = /healthz {
        include /etc/nginx/snippets/lisglosips-proxy.conf;
        proxy_pass http://lisglosips_api;
        access_log off;
    }

    location = /api/auth/login {
        include /etc/nginx/snippets/lisglosips-proxy.conf;
        limit_req zone=lisglosips_auth_per_ip burst=3 nodelay;
        proxy_pass http://lisglosips_api;
    }

    location /api/ {
        include /etc/nginx/snippets/lisglosips-proxy.conf;
        limit_req zone=lisglosips_api_per_ip burst=40 nodelay;
        proxy_pass http://lisglosips_api;
    }

    location /_recordings/ {
        internal;
        alias /data/recordings/;
        autoindex off;
        include /etc/nginx/snippets/lisglosips-security-headers.conf;
        add_header Accept-Ranges bytes always;
    }

    location /assets/ {
        try_files $uri =404;
        expires 7d;
        include /etc/nginx/snippets/lisglosips-security-headers.conf;
        add_header Cache-Control "public, immutable";
    }

    location / {
        try_files $uri $uri/ /index.html;
        expires -1;
        include /etc/nginx/snippets/lisglosips-security-headers.conf;
        add_header Cache-Control "no-store";
    }
}