# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# configuration of fw.op.fo / frode klevstul / oct 2025
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# http to https
server {
    listen 80;
    server_name fw.op.fo;
    return 301 https://$host$request_uri;
}

# hw to bare domain for https requests
#server {
#    listen 443 ssl http2;
#    listen [::]:443 ssl http2;
#
#    ssl_certificate /etc/nginx/acme.sh/op.fo/fullchain.pem;
#    ssl_certificate_key /etc/nginx/acme.sh/op.fo/key.pem;
#    ssl_trusted_certificate /etc/nginx/acme.sh/op.fo/cert.pem;
#
#    server_name hw.op.fo;
#    return 301 $scheme://op.fo$request_uri;
#}

http {
  # ...
  # upstream configuration
  upstream postgrest {
    server localhost:3000;
  }
}


server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;

    ssl_certificate /etc/nginx/acme.sh/op.fo/fullchain.pem;
    ssl_certificate_key /etc/nginx/acme.sh/op.fo/key.pem;
    ssl_trusted_certificate /etc/nginx/acme.sh/op.fo/cert.pem;

    add_header Strict-Transport-Security "max-age=63072000" always;

    root /var/www/fw.op.fo;
    index index.html;
    server_name fw.op.fo;

    # redirect 404 not found to the root
    location / {
	   error_page 404 = @myownredirect;
    }

    location @myownredirect {
        return 302 /;
    }

    # postgrest reverse proxy
    location /rpc/ {
      default_type  application/json;
      proxy_hide_header Content-Location;
      add_header Content-Location  /rpc/$upstream_http_content_location;
      #proxy_set_header  Connection "";
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_http_version 1.1;
      proxy_pass http://postgrest/;
    }

}