{{ ansible_managed | comment }}
server {
  listen 80;
  listen [::]:80;
  server_name {{ mumble_web_nginx_domains | join(' ') }};

  location / {
    return 301 https://$host$request_uri;
  }
  
{% if acme_enabled %}
  location ^~ /.well-known/acme-challenge/ {
		allow all;
		root {{ acme_root_dir }};
		try_files $uri =404;
	}
{% endif %}

  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name {{ mumble_web_nginx_domains | join(' ') }};

  ssl_certificate {{ mumble_web_certificate }};
  ssl_certificate_key {{ mumble_web_private_key }};

  ssl_session_timeout 1d;
  ssl_session_cache shared:AnsibleSSL:10m;  # about 40000 sessions
  ssl_session_tickets off;

{% if mumble_web_nginx_dhparam %}
  ssl_dhparam {{ mumble_web_nginx_dhparam }};
{% endif %}

  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
  ssl_prefer_server_ciphers off;

  add_header Strict-Transport-Security "max-age=63072000" always;

  # OCSP stapling
  ssl_stapling on;
  ssl_stapling_verify on;

{% if acme_enabled %}
  # Verify chain of trust of OCSP response using Root CA and Intermediate certs
  ssl_trusted_certificate {{ mumble_web_trusted_certificate }};
{% endif %}

  location / {
    root {{ mumble_web_dist_dir }};
  }

  location /mumble {
    proxy_pass http://localhost:{{ mumble_web_websockify_port }};
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
  }

  access_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-access.log;
  error_log {{ mumble_web_nginx_log_dir }}/{{ mumble_web_nginx_domains | first }}-error.log;
}

map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
}