relay/cmdeploy/src/cmdeploy/nginx/nginx.conf.j2

load_module modules/ngx_stream_module.so;

user www-data;
worker_processes auto;

# Increase the number of connections
# that a worker process can open
# to avoid errors such as
#   accept4() failed (24: Too many open files)
# and
#   socket() failed (24: Too many open files) while connecting to upstream
# in the logs.
# <https://nginx.org/en/docs/ngx_core_module.html#worker_rlimit_nofile>
worker_rlimit_nofile 2048;
pid /run/nginx.pid;
error_log syslog:server=unix:/dev/log,facility=local3;

events {
        # Increase to avoid errors such as
        #   768 worker_connections are not enough while connecting to upstream
        # in the logs.
        # <https://nginx.org/en/docs/ngx_core_module.html#worker_connections>
	worker_connections 2048;
	# multi_accept on;
}

stream {
        map $ssl_preread_alpn_protocols $proxy {
            default 127.0.0.1:8443;
            ~\bsmtp\b 127.0.0.1:465;
            ~\bimap\b 127.0.0.1:993;
        }

        server {
                listen 443;
                {% if not disable_ipv6 %}
                listen [::]:443;
                {% endif %}
                proxy_pass $proxy;
                ssl_preread on;
        }
}

http {
	sendfile on;
	tcp_nopush on;

	# Do not emit nginx version on error pages.
	server_tokens off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers on;
	ssl_certificate /var/lib/acme/live/{{ config.domain_name }}/fullchain;
	ssl_certificate_key /var/lib/acme/live/{{ config.domain_name }}/privkey;

	gzip on;

	server {
  
		listen 127.0.0.1:8443 ssl default_server;

		root /var/www/html;

		index index.html index.htm;

		server_name _;

		access_log syslog:server=unix:/dev/log,facility=local7;

		location / {
			# First attempt to serve request as file, then
			# as directory, then fall back to displaying a 404.
			try_files $uri $uri/ =404;
		}

		location /metrics {
			default_type text/plain;
		}

		location /new {
			if ($request_method = GET) {
				# Redirect to Delta Chat,
				# which will in turn do a POST request.
				return 301 dcaccount:https://{{ config.domain_name }}$request_uri;
			}

			fastcgi_pass unix:/run/fcgiwrap.socket;
			include /etc/nginx/fastcgi_params;
			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
			fastcgi_param QUERY_STRING $query_string;
		}

		# Old URL for compatibility with e.g. printed QR codes.
		#
		# Copy-paste instead of redirect to /new
		# because Delta Chat core does not follow redirects.
		#
		# Redirects are only for browsers.
		location /cgi-bin/newemail.py {
			if ($request_method = GET) {
				return 301 dcaccount:https://{{ config.domain_name }}$request_uri;
			}

			fastcgi_pass unix:/run/fcgiwrap.socket;
			include /etc/nginx/fastcgi_params;
			fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/newemail.py;
		}

                # Proxy to iroh-relay service.
                location /relay {
                        proxy_pass http://127.0.0.1:3340;
                        proxy_http_version 1.1;

                        # Upgrade header is normally set to "iroh derp http" or "websocket".
                        proxy_set_header Upgrade $http_upgrade;
                        proxy_set_header Connection "upgrade";
                }

		location /relay/probe {
                        proxy_pass http://127.0.0.1:3340;
                        proxy_http_version 1.1;
		}

		location /generate_204 {
                        proxy_pass http://127.0.0.1:3340;
                        proxy_http_version 1.1;
		}
	}

	# Redirect www. to non-www
	server {
		listen 127.0.0.1:8443 ssl;
		server_name www.{{ config.domain_name }};
		return 301 $scheme://{{ config.domain_name }}$request_uri;
		access_log syslog:server=unix:/dev/log,facility=local7;
	}
}