# /etc/nginx/sites-available/monitor-check
# Danach: ln -s ../sites-available/monitor-check /etc/nginx/sites-enabled/
#         nginx -t && systemctl reload nginx
#         certbot --nginx -d monitore.example.org

server {
    listen 80;
    listen [::]:80;
    server_name monitore.example.org;

    # Uploads vom Handy koennen gross sein
    client_max_body_size 20m;

    # Sicherheits-Header
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 120s;
    }

    # Hochgeladene Bilder direkt von der Platte ausliefern (schneller als durch Node)
    location /uploads/ {
        alias /var/lib/monitor-check/uploads/;
        expires 30d;
        add_header Cache-Control "public, immutable";
        add_header X-Content-Type-Options "nosniff" always;
        access_log off;
        # keine Ausfuehrung von hochgeladenen Dateien
        location ~* \.(php|pl|py|cgi|sh)$ { deny all; }
    }
}