upstream moments_api {
    server {{API_UPSTREAM_ADDR}} max_fails=3 fail_timeout=30s;
    keepalive 8;
}

server {
    server_name {{SERVER_NAME}};
    listen 443 ssl;
    http2 on;

    ssl_certificate /etc/letsencrypt/live/{{SERVER_NAME}}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/{{SERVER_NAME}}/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;

    root {{DOCROOT}};
    index index.html;

    # Compress text responses on the wire. text/html is always compressed when
    # gzip is on (nginx won't let it be listed in gzip_types); the prerendered
    # pages are large — the dashboard bakes the full all-time activity dataset —
    # so the HTML alone drops from ~900 KB to ~90 KB. gzip_proxied any also
    # compresses the JSON from the /api/ upstream. woff2 is already compressed,
    # so it's intentionally not listed.
    gzip on;
    gzip_vary on;
    gzip_comp_level 6;
    gzip_min_length 1024;
    gzip_proxied any;
    gzip_types
        text/css
        text/javascript
        text/plain
        text/xml
        application/javascript
        application/json
        application/manifest+json
        application/xml
        image/svg+xml
        font/ttf;

    location / {
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-cache" always;
    }

    location ~* ^(?!/api/)\S+\.(js|css|woff2?|ttf|eot|svg|png|jpg|jpeg|gif|ico|webp|avif)$ {
        expires 30d;
        add_header Cache-Control "public, max-age=2592000, immutable";
        try_files $uri =404;
    }

    location /api/ {
        rewrite ^/api/(.*)$ /$1 break;
        proxy_pass {{API_UPSTREAM_SCHEME}}://moments_api;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 30s;
        proxy_connect_timeout 5s;
    }

    access_log /var/log/nginx/{{SERVER_NAME}}.access.log;
    error_log  /var/log/nginx/{{SERVER_NAME}}.error.log;
}