server {
    listen 80;
    listen [::]:80;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name your.domain.tld; # Replace me!

    # Indicating this root directory is facultative and just avoids the
    # proxying of static assets requests through the NodeJS application. Unless
    # you have an awful lot of requests to your Kresus instance, it's not
    # necessary to enable it.
    # root /home/kresus/kresus/build/client/; # Replace me!

    # Create /home/kresus/.htpasswd file with `htpasswd -c /home/kresus/.htpasswd`.
    # In Debian, `htpasswd` is provided by the package `apache2-utils`.
    auth_basic Authentication;
    auth_basic_user_file /home/kresus/.htpasswd; # Replace me!

    # To create the certificate:
    # - comment all `ssl_*` directives in this file, along with the `rewrite`
    # - reload Nginx
    # - use that command (change your.domain.tld to your actual domain):
    #   mkdir -p /var/www/certbot && \
    #     certbot certonly --rsa-key-size 4096 --webroot -w /var/www/certbot/ \
    #       --email your_address@example.org --agree-tos --text \
    #       --renew-hook "/usr/sbin/nginx -s reload" -d your.domain.tld
    # - uncomment all `ssl_*` directives
    # - reload Nginx.
    ssl_certificate      /etc/letsencrypt/live/your.domain.tld/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/your.domain.tld/privkey.pem;

    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:5m;

    # This hardened SSL configuration may prevent you from accessing Kresus if
    # you use an old Web browser. If that's the case, go update your browser!
    ssl_prefer_server_ciphers On;
    ssl_protocols TLSv1.2;
    ssl_ciphers 'EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!CAMELLIA256-SHA:!AES256-SHA:!CAMELLIA128-SHA:!AES128-SHA';

    ssl_dhparam /etc/ssl/private/dhparam4096.pem; # Create it with `openssl dhparam -out /etc/ssl/private/dhparam4096.pem 4096`
    add_header Strict-Transport-Security max-age=15768000; # six months
    gzip off;

    if ($https != 'on') {
        rewrite .* https://$host/$request_uri permanent;
    }

    # Replace variables __PATH__ and __PORT__ here:
    # __PATH__: if you install kresus on yourdomain.tld/kresus, the value is
    # "kresus";
    #   -> it means it's a subpath, remember to remove the comment of the first
    #   line.
    #   -> this must match the value of `url_prefix` you used in Kresus's
    #   config.ini.
    # __PORT__: this must match the value of `port` you used in Kresus's
    # config.ini.
    location __PATH__/ {
        try_files $uri $uri/index.html @kresus;
    }

    location ~ __PATH__/\.(css|js|png|jpe?g|svg|eot|woff2?)$ {
        add_header Cache-Control 'max-age=2592000, must-revalidate, public';
        gzip_types text/plain text/css application/javascript text/javascript;
        gzip on;
        try_files $uri $uri/index.html @kresus;
    }

    location @kresus {
        client_max_body_size  8M;
        send_timeout          600;
        proxy_connect_timeout 600;
        proxy_send_timeout    600;
        proxy_read_timeout    600;
        proxy_set_header      Host $host;

        proxy_pass http://127.0.0.1:__PORT__;
        proxy_redirect off;
    }
}
