# MAPPEX — статический прототип на mappex.yappix.ru.
# Установка на сервере:
#   sudo certbot certonly --webroot -w /var/www/certbot -d mappex.yappix.ru   # сертификат (нужен блок :80)
#   sudo cp deploy/nginx-mappex.yappix.ru.conf /etc/nginx/sites-available/mappex.yappix.ru
#   sudo ln -sf /etc/nginx/sites-available/mappex.yappix.ru /etc/nginx/sites-enabled/
#   sudo nginx -t && sudo systemctl reload nginx

server {
    listen 80;
    listen [::]:80;
    server_name mappex.yappix.ru;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www/certbot;
        default_type "text/plain";
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name mappex.yappix.ru;

    ssl_certificate /etc/letsencrypt/live/mappex.yappix.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mappex.yappix.ru/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/mappex;
    index index.html;

    # воркер MapLibre — ES-модуль: браузер требует JavaScript-тип
    types {
        text/html html;
        text/css css;
        application/javascript js mjs;
        application/json json;
        application/geo+json geojson;
        image/svg+xml svg;
        image/png png;
        image/jpeg jpg jpeg;
        font/woff2 woff2;
        image/x-icon ico;
    }

    gzip on;
    gzip_vary on;
    gzip_comp_level 6;
    gzip_types text/css application/javascript application/json application/geo+json image/svg+xml;

    # файлы сборки с хешем в имени — навсегда
    location /assets/ {
        add_header Cache-Control "public, max-age=31536000, immutable" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        try_files $uri =404;
    }

    location /data/ {
        add_header Cache-Control "public, max-age=86400" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        try_files $uri =404;
    }

    location / {
        add_header Cache-Control "no-cache" always;
        add_header Strict-Transport-Security "max-age=31536000" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        try_files $uri $uri/ /index.html;
    }

    # заголовки безопасности — в каждом location: add_header там отменяет наследование с уровня server
    access_log /var/log/nginx/mappex-yappix-access.log;
    error_log /var/log/nginx/mappex-yappix-error.log;
}