sevhlidka.conf

# vim: ft=sh

upstream sevhlidka {
    server unix:/srv/sevhlidka/run/socket fail_timeout=5;
    server unix:/srv/sevhlidka/run/socket fail_timeout=5;
}

server {
    listen 0:80;
    listen [::]:80;
    listen 0:443 ssl http2;
    listen [::]:443 ssl http2;
    ssl_certificate     /etc/letsencrypt/live/is.sevhlidka.cz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/is.sevhlidka.cz/privkey.pem;

    server_name is.sevhlidka.cz;

    location /.well-known {
        root /srv/letsencrypt/htdocs;
    }

    location ~* \.php(/|$) {
        return 404;
    }

    location /static {
        access_log   off;
        expires      30d;
        root /srv/sevhlidka;
    }

    location /media {
        access_log   off;
        expires      30d;
        root /srv/sevhlidka;
    }

    location /__startup__.html {
        internal;
        root /srv/sevhlidka;
    }

    error_page 500 502 503 504 /__startup__.html;

    location /admin/ {
        client_max_body_size 4G;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://sevhlidka;
    }

    location / {
        client_max_body_size 512m;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://sevhlidka;
    }

    # redirections

    if ($scheme = http) {
        rewrite ^/(.*)$ https://is.sevhlidka.cz/$1 permanent;
    }

    access_log /var/log/nginx/sevhlidka.access.log;
    error_log  /var/log/nginx/sevhlidka.error.log;
}