# nginx server block for a Kokkoja web site: the client's files at
# https://kokkoja.andykopra.com/ and the relay at wss://kokkoja.andykopra.com/relay.
# Installed by deploy/setup_vps.sh as /etc/nginx/sites-available/kokkoja.
#
# This is the plain HTTP form.  certbot --nginx -d kokkoja.andykopra.com
# adds the TLS listener and turns this block into a redirect.

server {
    listen 80;
    server_name kokkoja.andykopra.com;

    root /var/www/kokkoja;
    index index.html;

    # The relay.  The client connects to <relay address>/room/<room id>,
    # so /relay/room/<id> here becomes /room/<id> at the relay.
    location /relay/ {
        proxy_pass http://127.0.0.1:8770/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Forwarded-For $remote_addr;
        # The relay pings every 20 seconds; a quiet lesson must not be cut off.
        proxy_read_timeout 1h;
        proxy_send_timeout 1h;
    }

    location / {
        try_files $uri $uri/ =404;
    }

    # The client is a few small files that change with every deployment:
    # browsers ask whether they have changed rather than keeping old ones.
    add_header Cache-Control "no-cache" always;
    # The client loads nothing from anywhere else, and may not be framed.
    add_header Content-Security-Policy "default-src 'self'; connect-src 'self' wss://kokkoja.andykopra.com; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'; form-action 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer" always;
}