daemon off;
pid /tmp/nginx.pid;
error_log /proc/1/fd/1 warn;

events {
    worker_connections 1024;
}

http {
    client_body_temp_path /tmp/client_body;
    proxy_temp_path       /tmp/proxy;
    fastcgi_temp_path     /tmp/fastcgi;
    uwsgi_temp_path       /tmp/uwsgi;
    scgi_temp_path        /tmp/scgi;

    access_log /proc/1/fd/1;

    include /etc/nginx/mime.types;
    types {
        application/javascript mjs;
    }
    default_type application/octet-stream;

    gzip_static on;

    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_comp_level 9;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json application/wasm application/x-javascript text/x-component;

    # HTTP on 8080 — redirect to HTTPS; root path returns 200 for HA watchdog
    server {
        listen 8080;
        listen [::]:8080;
        server_name localhost;

        location = / {
            return 200 "ok";
        }

        location / {
            return 301 https://$host:8443$request_uri;
        }
    }

    # HTTPS on 8443 — main browser access with SharedArrayBuffer support
    server {
        listen 8443 ssl;
        listen [::]:8443 ssl;
        server_name localhost;
        root /usr/share/nginx/html;
        index index.html;
        absolute_redirect off;

        ssl_certificate     /config/bentopdf/ssl/cert.pem;
        ssl_certificate_key /config/bentopdf/ssl/key.pem;
        ssl_protocols       TLSv1.2 TLSv1.3;
        ssl_ciphers         HIGH:!aNULL:!MD5;

        include /etc/nginx/snippets/bentopdf-locations.conf;
    }
}