user {{ nginx_user }};
worker_processes {{ nginx_worker_processes }};
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections {{ nginx_worker_connections }};
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    server_tokens off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    types_hash_max_size 4096;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_session_cache shared:SSL:10m;

    # Proxy settings
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Logging
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    {% if nginx_server_name | regex_search('\.local$') %}
    # HTTP server - serve .local domains
    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        server_name {{ nginx_server_name }};

        include /etc/nginx/conf.d/*.conf;
    }
    {% else %}
    # HTTP server - redirect to HTTPS
    server {
        listen 80 default_server;
        listen [::]:80 default_server;

        server_name {{ nginx_server_name }};

        location / {
            return 301 https://$server_name$request_uri;
        }
    }
    {% endif %}

    # HTTPS server
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name {{ nginx_server_name }};

        ssl_certificate {{ nginx_ssl_certificate }};
        ssl_certificate_key {{ nginx_ssl_certificate_key }};
        ssl_session_timeout 1d;

        add_header X-Content-Type-Options nosniff always;
        add_header X-Frame-Options DENY always;

        include /etc/nginx/conf.d/*.conf;
    }

    include /etc/nginx/vhosts.d/*.conf;
}