# /etc/nginx/nginx.conf — InterGenOS default-secure config for nginx.
#
# This config ships with the nginx package and is designed to start
# safely on a fresh InterGenOS install:
#
#   - Bind 127.0.0.1 only (loopback). Operators expose to network
#     interfaces deliberately by editing the `listen` directives below.
#   - server_tokens off (no version banner in headers / error pages).
#   - TLS-only :443 server with the self-signed cert auto-generated at
#     package install time (/etc/nginx/ssl/server.{crt,key}). Replace
#     the self-signed pair with a real CA-signed cert for production.
#   - Status endpoint at /nginx_status locked to 127.0.0.1 via the
#     allow/deny pair (defense-in-depth alongside the loopback bind).
#   - No default autoindex anywhere.

user                 nginx;
worker_processes     auto;
worker_rlimit_nofile 4096;

error_log /var/log/nginx/error.log warn;
pid       /run/nginx.pid;

events {
    worker_connections 1024;
    multi_accept       on;
    use                epoll;
}

http {
    include            mime.types;
    default_type       application/octet-stream;

    server_tokens      off;

    sendfile           on;
    tcp_nopush         on;
    tcp_nodelay        on;
    keepalive_timeout  65;
    types_hash_max_size 4096;

    gzip               on;
    gzip_vary          on;
    gzip_proxied       any;
    gzip_comp_level    5;
    gzip_min_length    256;
    gzip_types
        application/json
        application/javascript
        application/xml
        application/xml+rss
        application/atom+xml
        application/rss+xml
        text/css
        text/javascript
        text/plain
        text/xml;

    # Log format with no client IP by default (privacy posture).
    # Operators wanting full access logs flip to `combined` and accept
    # the data-residency tradeoff.
    log_format minimal '$time_iso8601 $request_method $request_uri $status $body_bytes_sent';
    access_log /var/log/nginx/access.log minimal;

    include /etc/nginx/conf.d/*.conf;

    # TLS-only default server (port 443, loopback only)
    server {
        listen       127.0.0.1:443 ssl;
        listen       [::1]:443     ssl;
        http2        on;
        http3        on;
        server_name  localhost;

        ssl_certificate         /etc/nginx/ssl/server.crt;
        ssl_certificate_key     /etc/nginx/ssl/server.key;
        ssl_protocols           TLSv1.2 TLSv1.3;
        ssl_ciphers             HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        ssl_session_cache       shared:SSL:10m;
        ssl_session_timeout     10m;
        ssl_session_tickets     off;

        # OCSP stapling — replace cert path when using real CA cert
        # ssl_stapling on;
        # ssl_stapling_verify on;

        location / {
            root  /usr/share/nginx/html;
            index index.html;
        }

        # Healthcheck / metrics endpoint — loopback-locked. The
        # allow/deny pair is defense-in-depth alongside the loopback
        # `listen`; if an operator broadens the listen address, the
        # status endpoint remains loopback-restricted unless they
        # also edit the allow directive.
        location = /nginx_status {
            stub_status on;
            access_log  off;
            allow       127.0.0.1;
            allow       ::1;
            deny        all;
        }
    }

    # HTTP -> HTTPS redirect (loopback only — same posture; operators
    # opt in to public exposure by editing both server blocks).
    server {
        listen       127.0.0.1:80;
        listen       [::1]:80;
        server_name  localhost;

        location / {
            return 301 https://$host$request_uri;
        }
    }
}
