# Replace your-server-name.example.com with the hostname of your server
# In your Yuebing config, this hostname should match the one in your YB_SITE_URL
# env var, or in 'Site URL' in admin settings, if Yuebing is already running
server {
    listen 80;
    server_name your-server-name.example.com;

    location / {
        # Below we assume Yuebing is running locally; change the `127.0.0.1` if Yuebing is running somewhere else
        proxy_pass http://127.0.0.1:3000/;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host your-server-name.example.com;
        proxy_set_header X-Forwarded-Proto https;
    }

    # Certbot
    #   Installation: apt install python3-certbot-nginx
    #   Renewals:
    #     Add a script in /etc/cron.weekly/certbot_renew to check for renewal weekly
    #     For example:
    #         echo "#/bin/bash
    #               certbot renew --nginx" >> /etc/cron.weekly/certbot_renew && \
    #         chmod a+rx /etc/cron.weekly/certbot_renew
    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/html;
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/your-server-name.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-server-name.example.com/privkey.pem;
    ssl_session_cache shared:le_nginx_SSL:1m;
    ssl_session_timeout 1440m;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA";

    if ($scheme != "https") {
        return 301 https://$host$request_uri;
    }
}