# ValidBoard — nginx site
#
#   sudo cp deploy/board.jihakuz.xyz.conf /etc/nginx/sites-available/board.jihakuz.xyz
#   sudo ln -s /etc/nginx/sites-available/board.jihakuz.xyz /etc/nginx/sites-enabled/
#   sudo nginx -t && sudo systemctl reload nginx
#   sudo certbot --nginx -d board.jihakuz.xyz
#
# Plain http only, on purpose — certbot adds the 443 server block, the
# certificate lines and the http->https redirect itself.

server {
    listen 80;
    listen [::]:80;

    server_name board.jihakuz.xyz;

    # ValidBoard rejects cross-site writes by comparing the browser's Origin
    # header against the URL it thinks it is serving. It builds that URL from
    # the headers below, so without X-Forwarded-Proto it will believe it is on
    # http:// while the browser says https:// — and every save comes back 403
    # the moment certbot switches the site to TLS.
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # The whole board set is inlined into the page at load, so it is worth
    # compressing; it's all text.
    gzip on;
    gzip_types text/html application/json application/javascript text/css;
    gzip_min_length 1024;

    # Matches the server's own 2 MB per-item cap, with room for the envelope.
    client_max_body_size 4m;

    location / {
        proxy_pass http://127.0.0.1:8047;
    }
}