# zagan.bet download page — nginx + php-fpm example.
#
# Install at /etc/nginx/conf.d/zagan.bet.conf (the packaged nginx.conf includes
# conf.d/*.conf). Replace the server name, root and certificate paths.
#
# Only index.php is PHP; everything under /bin/ is served as static files.
# The binaries are versioned, so they can be cached forever — which means you
# must bump the version (Cargo.toml) instead of overwriting a published file.

server {
    listen 80;
    listen [::]:80;
    server_name dl.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name dl.example.com;

    root /srv/zagan.bet;
    index index.php;

    ssl_certificate     /etc/letsencrypt/live/dl.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dl.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # Published binaries: static, versioned, never rewritten.
    location /bin/ {
        try_files $uri =404;
        add_header Cache-Control "public, max-age=31536000, immutable";
    }

    # The page rescans bin/ on every request, so don't cache it.
    location = /index.php {
        include fastcgi_params;
        fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        add_header Cache-Control "no-cache";
    }

    location / {
        try_files $uri $uri/ =404;
    }

    # Never serve dotfiles (.gitignore, editor leftovers).
    location ~ /\. {
        deny all;
    }
}