## Example config for http redirects
server {
	listen 80;
	listen [::]:80 default;
	server_name nominatim.example.com;

	return 301 https://$server_name$request_uri;
}

## Example config for server secured with https
server {
	listen 0.0.0.0:443 ssl http2;
	listen [::]:443 ssl http2;
	server_name nominatim.example.com;

	access_log /var/log/nginx/nominatim.example.com/access.log combined if=$log_ip;
	error_log  /var/log/nginx/nominatim.example.com/error.log;

	root /usr/share/webapps/nominatim-ui/;

	add_header X-Frame-Options DENY;

	# index.html only redirects to search.html anyway
	location = / {
		return 301 /search.html;
	}

	# UI paths
	location ~ ^/(about.html|deletable.html|details.html|polygons.html|reverse.html|search.html|status.html|config.defaults.js|build/|mapicons/|theme/) {
	}
	
	# Nominatim APIs for access on the same vhost
	location / {
		proxy_set_header Host $http_host;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_redirect off;
		proxy_pass http://nominatim_service;
	}

	add_header Feature-Policy "geolocation 'none'; midi 'none'; notifications 'none'; push 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; speaker 'none'; vibrate 'none'; fullscreen 'none'; payment 'none'";

	add_header Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self'; img-src 'self' data: https://tile.openstreetmap.org; connect-src 'self'; font-src 'self'; object-src 'none'; media-src 'self'; worker-src 'none'; frame-src 'none'; form-action 'self'; frame-ancestors 'none'; base-uri 'self';";

	add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
	add_header Referrer-Policy "no-referrer, strict-origin-when-cross-origin";
	add_header X-Content-Type-Options nosniff;
	add_header X-XSS-Protection "1; mode=block";

	ssl_protocols TLSv1.2 TLSv1.3;

	ssl_ciphers "EECDH+AESGCM+SHA384";

	ssl_prefer_server_ciphers on;
	ssl_ecdh_curve secp384r1;
	ssl_session_cache shared:SSL:10m;
	ssl_session_tickets off;
	ssl_stapling on;
	ssl_stapling_verify on;

	# openssl dhparam -out /etc/ssl/dhparam.pem 4096
	ssl_dhparam /etc/ssl/dhparam.pem;

	# See https://wiki.archlinux.org/index.php/Certbot
	ssl_certificate /etc/letsencrypt/live/nominatim.example.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/nominatim.example.com/privkey.pem;
}

# vi:syntax=nginx
