# backup uploads: a few pieces a second at most, per address
limit_req_zone $binary_remote_addr zone=privapub_backup_uploads:1m rate=120r/m;

server {
	listen 80;
	listen [::]:80;
	server_name privapub.thepra.dev;

	location ^~ /.well-known/acme-challenge/ {
		root /var/www/acme;
		default_type "text/plain";
	}

	location / {
		return 301 https://$host$request_uri;
	}
}

server {
	listen       443 ssl;
	listen 8444 ssl proxy_protocol;
	listen       [::]:443 ssl;
	server_name  privapub.thepra.dev;
	http2 on;

	include /etc/nginx/ssl.conf;
	ssl_certificate     /root/.acme.sh/privapub.thepra.dev_ecc/fullchain.cer;
	ssl_certificate_key /root/.acme.sh/privapub.thepra.dev_ecc/privapub.thepra.dev.key;
	include /etc/nginx/snippets/privapub-headers.conf;

	access_log /var/log/nginx/privapub.thepra.dev.access.log;
	error_log  /var/log/nginx/privapub.thepra.dev.error.log;

	client_max_body_size 2m;

	location ^~ /.well-known/acme-challenge/ {
		root /var/www/acme;
		default_type "text/plain";
	}

	location ~ ^/api/v[12]/media$|^/api/v1/accounts/update_credentials$ {
		client_max_body_size 100m;
		proxy_request_buffering off;
		proxy_pass         http://127.0.0.1:6970;
		proxy_http_version 1.1;
		proxy_set_header   Connection "";
		proxy_set_header   Host $host;
		proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header   X-Real-IP $remote_addr;
		proxy_set_header   X-Forwarded-Proto $scheme;
		proxy_read_timeout 300s;
	}

	# the administrator's backups and the personas' archives (owner decision 2026-10-07): a download streams a whole one for
	# as long as it takes; an upload arrives in pieces of at most 32 MB, unbuffered
	location ~ ^/clientapi/(admin/backups|persona/archive)/download/ {
		proxy_buffering    off;
		proxy_pass         http://127.0.0.1:6970;
		proxy_http_version 1.1;
		proxy_set_header   Connection "";
		proxy_set_header   Host $host;
		proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header   X-Real-IP $remote_addr;
		proxy_set_header   X-Forwarded-Proto $scheme;
		proxy_read_timeout 3600s;
		proxy_send_timeout 3600s;
	}
	location ~ ^/clientapi/(admin/backups|persona/archive)/uploads {
		client_max_body_size 40m;
		proxy_request_buffering off;
		limit_req zone=privapub_backup_uploads burst=30 nodelay;
		proxy_pass         http://127.0.0.1:6970;
		proxy_http_version 1.1;
		proxy_set_header   Connection "";
		proxy_set_header   Host $host;
		proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header   X-Real-IP $remote_addr;
		proxy_set_header   X-Forwarded-Proto $scheme;
		proxy_read_timeout 300s;
	}
	location ^~ /media/proxy/ {
		proxy_buffering    off;
		proxy_pass         http://127.0.0.1:6970;
		proxy_http_version 1.1;
		proxy_set_header   Connection "";
		proxy_set_header   Host $host;
		proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header   X-Real-IP $remote_addr;
		proxy_set_header   X-Forwarded-Proto $scheme;
		proxy_read_timeout 600s;
	}

	location / {
		proxy_pass         http://127.0.0.1:6970;
		proxy_http_version 1.1;
		proxy_set_header   Connection "";
		proxy_set_header   Host $host;
		proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header   X-Real-IP $remote_addr;
		proxy_set_header   X-Forwarded-Proto $scheme;
		proxy_read_timeout 60s;
	}
}