# The HEOS panel at https://domain.com/heos
#
#   sudo cp /var/www/html/heos/deploy/heos.nginx.conf /etc/nginx/sites-available/heos
#   sudo ln -s /etc/nginx/sites-available/heos /etc/nginx/sites-enabled/heos
#   sudo nginx -t && sudo systemctl reload nginx
#
# server_name and the certificate paths have to agree: the paths are the
# directory certbot made for that name.
#
# nginx reaches the panel on port 5443 (WEB_PORT in config.py). To make
# nginx the only way in, add --host 127.0.0.1 to ExecStart in
# deploy/heos-panel.service; by default the panel also answers directly on
# the LAN at <server-ip>:5443.

server {
    listen 80;
    listen [::]:80;

    server_name domain.com;

    # Nothing is served in the clear. certbot's nginx plugin works through
    # this block when it renews, so the redirect does not get in its way.
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    # http2 on;      # nginx 1.25.1+. Older builds: listen 443 ssl http2;

    server_name domain.com;

    ssl_certificate     /etc/letsencrypt/live/domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;

    # certbot's own settings, kept current by it -- the same thing the maui
    # Apache vhost does with options-ssl-apache.conf. Both files appear when
    # certbot configures a host; if this cert came another way (DNS
    # challenge, standalone, copied from elsewhere) they may not exist and
    # nginx -t will say so. Then drop these two lines for:
    #     ssl_protocols       TLSv1.2 TLSv1.3;
    #     ssl_session_cache   shared:SSL:10m;
    #     ssl_session_timeout 1d;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # This host is the panel and nothing else, so refuse the rest rather
    # than falling back on nginx's default root and serving whatever
    # happens to sit there. Drop this block if the machine serves more.
    location / {
        return 404;
    }

    # A bare /heos misses the location below -- it would fall through to
    # the 404 above -- so send it to the slashed form first.
    location = /heos {
        return 301 /heos/;
    }

    location /heos/ {
        # The panel controls the speakers, and this hostname may well
        # resolve from outside. Keep it to the house unless you mean
        # otherwise: drop these four lines to let it answer from anywhere.
        allow 192.168.0.0/24;
        allow 127.0.0.1;
        allow ::1;
        deny all;

        # The trailing slash is what strips /heos/ back off before the
        # request reaches the app.
        proxy_pass http://127.0.0.1:5443/;

        # Tells the app it is mounted on a sub-path, so every link, icon and
        # fetch it generates is /heos/... rather than /... Without this the
        # page loads and nothing on it works.
        proxy_set_header X-Forwarded-Prefix /heos;

        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

# Want the panel at the root of this host instead of under /heos? Replace
# the three location blocks in the 443 server with the one below, and leave
# X-Forwarded-Prefix out of it -- the app is not on a sub-path then, and
# generates /static/... and /api/... just as it does on port 5443.
#
#     location / {
#         proxy_pass http://127.0.0.1:5443;
#         proxy_set_header Host              $host;
#         proxy_set_header X-Real-IP         $remote_addr;
#         proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
#         proxy_set_header X-Forwarded-Proto $scheme;
#         proxy_http_version 1.1;
#         proxy_set_header Connection "";
#     }