# Serves src/ directly. Drop into /etc/nginx/sites-available/motionity and
# point ssl_certificate at your own files.
#
# TLS is not decoration here: WebCodecs (the fast exporter) and IndexedDB
# (project saving) are secure-context only, so the app loses both when reached
# over plain http:// on anything other than localhost.

server {
    listen 80;
    listen [::]:80;
    server_name motionity.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name motionity.example.com;

    ssl_certificate     /etc/letsencrypt/live/motionity.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/motionity.example.com/privkey.pem;

    root /opt/motionity/src;
    index index.html;

    # The audio and video panels seek, which needs byte ranges (on by default).
    # Large media should not be buffered through gzip.
    gzip on;
    gzip_types text/css text/javascript application/javascript application/json image/svg+xml;
    gzip_min_length 1024;

    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy no-referrer always;

    location = /index.html {
        add_header Cache-Control "no-cache" always;
    }

    location ~* \.(js|css|svg|png|jpe?g|gif|webp|woff2?|mp3|wav|mp4|webm)$ {
        add_header Cache-Control "public, max-age=604800" always;
    }

    location / {
        try_files $uri $uri/ =404;
    }
}