# Replace the name and certificate paths. See docs/guides/reverse-proxy.md.
map $http_upgrade $tolktak_connection {
    default upgrade;
    ''      close;
}

server {
    listen 443 ssl;   # adapt to how your nginx terminates TLS
    http2 on;
    server_name chat.example.com;
    ssl_certificate     /etc/ssl/tolktak/chat.example.com.crt;
    ssl_certificate_key /etc/ssl/tolktak/chat.example.com.key;
    add_header Strict-Transport-Security "max-age=31536000" always;
    client_max_body_size 1m;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $tolktak_connection;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Proto https;
    proxy_read_timeout 120s; # server pings every 25 s

    location / {
        proxy_pass http://127.0.0.1:8080;
    }
    location = /api/v1/files {
        client_max_body_size 60m; # TOLKTAK_MAX_UPLOAD_MB plus overhead
        proxy_pass http://127.0.0.1:8080;
    }
    # LiveKit calls the webhook on 127.0.0.1, never through the proxy.
    location = /api/v1/livekit/webhook {
        return 404;
    }

    # LiveKit signalling; calls themselves go over UDP 7882 or TCP 7881 directly.
    location /rtc {
        proxy_pass http://127.0.0.1:7880;
        proxy_read_timeout 3600s;
    }
}