events {
    worker_connections 1024;
}

http {
    proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=peertube_cache:10m max_size={{ cache_size_gb }}g use_temp_path=off;

    server {
        listen 9000;

        # Hide nginx version
        server_tokens off;

        # Enable compression for JS/CSS/HTML bundle, for improved client load times.
        # It might be nice to compress JSON, but leaving that out to protect against potential
        # compression+encryption information leak attacks like BREACH.
        gzip on;
        gzip_types text/css application/javascript;
        gzip_vary on;

        # Enable HSTS
        # Tells browsers to stick with HTTPS and never visit the insecure HTTP
        # version. Once a browser sees this header, it will only visit the site over
        # HTTPS for the next 2 years: (read more on hstspreload.org)
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";

        add_header Referrer-Policy "same-origin";

        location / {
            proxy_pass              http://peertube:9000;
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        Host $host;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            client_max_body_size    600M;
            proxy_connect_timeout   600;
            proxy_send_timeout      600;
            proxy_read_timeout      600;
            send_timeout            600;
        }
        location ~ ^/(static/(thumbnails|previews|avatars)|client)/ {
            proxy_pass              http://peertube:9000;
            proxy_cache             peertube_cache;
            proxy_cache_use_stale   error timeout http_500 http_502 http_503 http_504;
            proxy_cache_revalidate  on;
            proxy_cache_min_uses    3;
            proxy_cache_lock        on;
            add_header              X-Cached $upstream_cache_status;
        }
        location ~ ^/static/(webseed|redundancy)/ {
            slice                   1m;
            proxy_cache             peertube_cache;
            proxy_cache_valid       206 1h;
            proxy_cache_key         $uri$is_args$args$slice_range;
            proxy_set_header        Range $slice_range;
            # for debugging
            #add_header              X-Cache-Status $upstream_cache_status;
            proxy_http_version      1.1;
            # required workaround for https://github.com/Chocobozzz/PeerTube/issues/1777
            proxy_ignore_headers    Cache-Control;
            proxy_pass              http://peertube:9000;
        }
    }
}