# Replace every double-underscore placeholder before validation or deployment.
# Generate the deployable file with scripts/generate-host-config.mjs; this file
# intentionally contains no real production hostname, certificate path, or root.

# Requires standard MIME mappings and static-file defaults in the parent Nginx http context.
max_ranges 1;

map $uri $portfolio_cache_control {
  default "public, max-age=0, must-revalidate";
  __EXACT_HASHED_ASSET_RULES__
}

server {
  listen 80;
  server_name __CANONICAL_HOST__ __ALTERNATE_HOSTS__;
  return 308 https://__CANONICAL_HOST__$request_uri;
}

server {
  listen 443 ssl;
  server_name __CANONICAL_HOST__;
  ssl_certificate __TLS_CERTIFICATE_PATH__;
  ssl_certificate_key __TLS_KEY_PATH__;
  ssl_protocols TLSv1.2 TLSv1.3;
  root __DOCUMENT_ROOT__;
  index index.html;

  gzip on;
  gzip_vary on;
  gzip_min_length 1;
  gzip_types text/css application/javascript application/json image/svg+xml;

  add_header Content-Security-Policy "default-src 'self'; script-src 'self' '__JSON_LD_CSP_HASH__'; style-src 'self'; img-src 'self' data:; media-src 'self'; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests" always;
  add_header X-Content-Type-Options "nosniff" always;
  add_header Referrer-Policy "no-referrer" always;
  add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=()" always;
  add_header X-Frame-Options "DENY" always;
  add_header Cache-Control $portfolio_cache_control always;
  add_header Strict-Transport-Security "max-age=31536000" always;
  add_header X-Portfolio-Manifest-Digest "__MANIFEST_DIGEST__" always;

  location = / { try_files /index.html =404; }
  location = /index.html { try_files /index.html =404; }
  location = /robots.txt { try_files /robots.txt =404; }
  location = /sitemap.xml { try_files /sitemap.xml =404; }
  location /assets/ { try_files $uri =404; }
  location / { return 404; }
}