{%if nginx_serve_http %}
server {
    listen                  80{%if default_server %} default_server{% endif %};
    listen                  [::]:80{%if default_server %} default_server{% endif %};

    server_name             {{ http_hosts }};

    return                  301 https://{{ app_fqdn }}$request_uri;
}
{% endif %}

server {
    listen                  443 ssl http2{%if default_server %} default_server{% endif %};
    listen                  [::]:443 ssl http2{%if default_server %} default_server{% endif %};

    server_name             {{ app_fqdn }};

    ssl_certificate         /etc/letsencrypt/live/{{ letsencrypt_domain }}/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/{{ letsencrypt_domain }}/privkey.pem;
{% if ssl_trusted_certificate %}
    ssl_trusted_certificate {{ ssl_trusted_certificate }};
{% else %}
    ssl_trusted_certificate /etc/letsencrypt/live/{{ letsencrypt_domain }}/chain.pem;
{% endif %}

{% if authelia_enabled %}
{% if authelia_on_localhost %}
    include                 snippets/authelia.conf;
{% else %}
    include                 snippets/authelia-fqdn.conf;
{% endif %}
{% endif %}
    include                 snippets/ssl.conf;
    include                 snippets/misc.conf;
{% if firewall_enabled %}
    include                 snippets/waf.conf;
{% endif %}

    location / {
        proxy_pass          {{ transport }}://{{ proxy_pass_url }}:{{ proxy_pass_port }};
        include             snippets/{{ proxy_file }};
{% if theme_url %}
        set $theme {{ theme_url }};
        include             snippets/theme.conf;
{% endif %}
{% if intercept_errors %}
        include             snippets/proxy-errors.conf;
{% endif %}
{% if authelia_enabled %}
        include             snippets/auth.conf;
{% endif %}
{% if waf_rules %}
        include             /etc/nginx/modsec/sites/{{ waf_rules }}.conf;
{% endif %}
{% if proxy_certificate %}
        proxy_ssl_certificate {{ proxy_certificate }};
{% endif %}
{% if proxy_certificate_key %}
        proxy_ssl_certificate_key {{ proxy_certificate_key }};
{% endif %}
{% if proxy_certificate_trusted %}
        proxy_ssl_trusted_certificate {{ proxy_certificate_trusted }}; # Source: https://docs.nginx.com/nginx/admin-guide/security-controls/securing-http-traffic-upstream/
        proxy_ssl_verify    on;
        proxy_ssl_verify_depth 2;
        proxy_ssl_session_reuse on;
{% endif %}
    }
{% if app_id == 'maas' %}

    location /MAAS/ws {
        proxy_pass          {{ transport }}://{{ proxy_pass_url }}:{{ proxy_pass_port }}/MAAS/ws;
        include             snippets/proxy-ws.conf;
{% if intercept_errors %}
        include             snippets/proxy-errors.conf;
{% endif %}
{% if authelia_enabled %}
        include             snippets/auth.conf;
{% endif %}
{% if waf_rules %}
        include             /etc/nginx/modsec/sites/{{ waf_rules }}.conf;
{% endif %}
    }
{% endif %}
{% if app_id == 'portainer' %}

    location /ws/ {
        proxy_pass          {{ transport }}://{{ proxy_pass_url }}:{{ proxy_pass_port }}/ws/;
        include             snippets/proxy-ws.conf;
{% if intercept_errors %}
        include             snippets/proxy-errors.conf;
{% endif %}
{% if authelia_enabled %}
        include             snippets/auth.conf;
{% endif %}
{% if waf_rules %}
        include             /etc/nginx/modsec/sites/{{ waf_rules }}.conf;
{% endif %}
    }
{% endif %}
{% if 'unifi' in app_id %}

    location /wss/ {
        proxy_pass          {{ transport }}://{{ proxy_pass_url }}:{{ proxy_pass_port }};
        include             snippets/proxy-ws.conf;
{% if intercept_errors %}
        include             snippets/proxy-errors.conf;
{% endif %}
        proxy_redirect      off;
{% if authelia_enabled %}
        include             snippets/auth.conf;
{% endif %}
{% if waf_rules %}
        include             /etc/nginx/modsec/sites/{{ waf_rules }}.conf;
{% endif %}
    }
{% endif %}
}