server {
    listen 80;
    server_name admin.staging.rebreak.org;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name admin.staging.rebreak.org;

    # SSL-Cert: eigenes Cert via certbot (nicht Wildcard).
    # Befehle -- User muss einmalig auf Server ausfuehren (benötigt DNS-A-Record):
    #
    #   certbot certonly --nginx \
    #     -d admin.staging.rebreak.org \
    #     --non-interactive --agree-tos -m chahinebrini@gmail.com
    #
    # Danach nginx reload:
    #   nginx -t && systemctl reload nginx
    #
    # Falls bereits ein *.staging.rebreak.org Wildcard-Cert existiert:
    # Pfad anpassen auf /etc/letsencrypt/live/staging.rebreak.org/fullchain.pem
    # und /etc/letsencrypt/live/staging.rebreak.org/privkey.pem
    ssl_certificate     /etc/letsencrypt/live/admin.staging.rebreak.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/admin.staging.rebreak.org/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
    # Admin-App: niemals indexieren
    add_header X-Robots-Tag "noindex, nofollow" always;

    location / {
        proxy_pass http://127.0.0.1:3017;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        'upgrade';
        proxy_cache_bypass                 $http_upgrade;
        proxy_read_timeout 60s;
        proxy_connect_timeout 10s;
        client_max_body_size 10M;
    }
}
