# Sleep Heart website — health.wyrs365.com
# Public :443 is stream ssl_preread (stream.d/spark-sni.conf, default → 127.0.0.1:8443).
# TLS terminates on loopback :8443. Certificate is this name only.

server {
    listen 80;
    listen [::]:80;
    server_name health.wyrs365.com;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 127.0.0.1:8443 ssl proxy_protocol;
    listen [::1]:8443 ssl proxy_protocol;
    http2 on;
    server_name health.wyrs365.com;

    ssl_certificate     /etc/letsencrypt/live/health.wyrs365.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/health.wyrs365.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:HealthSSL:10m;

    add_header Strict-Transport-Security "max-age=31536000" always;
    add_header X-Content-Type-Options nosniff always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    root /var/www/health.wyrs365.com;
    index index.html;
    charset utf-8;

    location = /favicon.ico {
        try_files /assets/icon.png =404;
        access_log off;
        expires 7d;
    }

    location /assets/ {
        expires 7d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    location = /download {
        try_files /download/index.html =404;
    }

    location = /delete {
        try_files /delete/index.html =404;
    }

    location = /privacy {
        try_files /privacy/index.html =404;
    }

    location = /terms {
        try_files /terms/index.html =404;
    }

    location = /download/ { return 301 /download$is_args$args; }
    location = /delete/ { return 301 /delete$is_args$args; }
    location = /privacy/ { return 301 /privacy$is_args$args; }
    location = /terms/ { return 301 /terms$is_args$args; }

    location / {
        try_files $uri $uri/ /index.html;
    }
}