user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    # Gzip Settings
    gzip  on; # Enabled gzip
    gzip_disable "msie6"; # no gzip for IE6

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types
        application/atom+xml
        application/javascript
        application/json
        application/ld+json
        application/manifest+json
        application/rss+xml
        application/vnd.geo+json
        application/vnd.ms-fontobject
        application/x-font-ttf
        application/x-web-app-manifest+json
        application/xhtml+xml
        application/xml
        font/opentype
        image/bmp
        image/svg+xml
        image/x-icon
        text/cache-manifest
        text/css
        text/plain
        text/vcard
        text/vnd.rim.location.xloc
        text/vtt
        text/x-component
        text/x-cross-domain-policy;

    server_tokens off; # Hide Nginx version for security

    server {
        listen 80;
        listen [::]:80;

        # For SSL, uncomment and configure the lines below
        # listen 443 ssl http2;
        # listen [::]:443 ssl http2;
        # ssl_certificate /path/to/your/fullchain.pem; # EDIT THIS
        # ssl_certificate_key /path/to/your/privkey.pem; # EDIT THIS

        # Recommended SSL settings
        # ssl_protocols TLSv1.2 TLSv1.3;
        # ssl_prefer_server_ciphers on;
        # ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        # ssl_session_cache shared:SSL:10m;
        # ssl_session_timeout 1d;
        # ssl_session_tickets off;

        # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
        # add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

        # OCSP Stapling
        # ssl_stapling on;
        # ssl_stapling_verify on;
        # resolver 8.8.8.8 8.8.4.4 valid=300s; # Use your preferred DNS resolvers
        # resolver_timeout 5s;

        server_name mobea.de www.mobea.de;
        root /usr/share/nginx/html;

        index index.html;

        location = /favicon.ico {
            log_not_found off;
            access_log off;
        }

        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }

        # Cache static assets
        location ~* \.(?:css|js)$ {
            expires 1y;
            add_header Cache-Control "public, max-age=31536000, immutable, no-transform";
            access_log off;
        }

        location ~* \.(?:jpg|jpeg|gif|png|webp|svg|ico|woff|woff2|ttf|eot|otf)$ {
            expires 1y;
            add_header Cache-Control "public, max-age=31536000, immutable, no-transform";
            access_log off;

            # Hotlink prevention
            # Allow your own domain, subdomains, common search engines, and direct access (none)
            # You can add more domains to the list if needed, e.g. ~.anothercdn.com
            valid_referers none blocked server_names
                           ~\.google\. ~.bing\. ~.yahoo\. ~.duckduckgo\.; # Search engines

            if ($invalid_referer) {
                # Consider serving a placeholder image instead of 403 if preferred
                # rewrite ^/images/(.*)$ /images/hotlink-placeholder.png last;
                return 403; # Forbidden
            }
        }

        # Prevent access to .hidden files and directories (e.g., .git)
        location ~ /\. {
            deny all;
            log_not_found off;
            access_log off;
        }

        # Deny access to .sh files
        location ~* \.sh$ {
            deny all;
            log_not_found off;
            access_log off;
        }

        # Deny access to .md files (like TODO.md)
        location ~* \.md$ {
            deny all;
            log_not_found off;
            access_log off;
        }

        location / {
            try_files $uri $uri/ /index.html;
            add_header Cache-Control "no-cache, must-revalidate";
        }

        # Error pages (optional, create these files or Nginx uses defaults)
        # error_page 403 /403.html;
        # error_page 404 /404.html;
        # location = /40x.html { # A generic page for 403 and 404
        #     root /var/www/errors; # Path to your error pages
        #     internal;
        # }
        # error_page 500 502 503 504 /50x.html;
        # location = /50x.html {
        #     root /var/www/errors; # Path to your error pages
        #     internal;
        # }
    }

    include /etc/nginx/conf.d/*.conf;
}