server {
  listen ${NGINX_LISTEN};
  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
  ssl_certificate /etc/nginx/ssl/selfsigned.crt;
  ssl_certificate_key /etc/nginx/ssl/selfsigned.key;

  server_name _;
  root /tdrive-core/web;

  add_header Strict-Transport-Security "max-age=31536000";

  location /.well-known {
      alias /tdrive-react/build/.well-known/;

      gzip on;
      gzip_disable "msie6";

      add_header Cache-Control "no-store, public, max-age=0";
      add_header Cross-Origin-Opener-Policy 'same-origin-allow-popups; report-to="DurableDeepLinkUi"';
      add_header Cross-Origin-Resource-Policy "same-site";
      add_header Content-Type "application/json; charset=utf-8";
      add_header Last-Modified "";
      add_header Vary "Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site";
      add_header X-Content-Type-Options "nosniff";
      add_header X-Frame-Options "SAMEORIGIN";
      add_header X-XSS-Protection "0";

      proxy_buffering off;
      if_modified_since off;
      expires 0s;
      allow all;
   
      try_files $uri /index.html;
  }

  location / {
      gzip on;
      gzip_disable "msie6";

      gzip_comp_level 6;
      gzip_min_length 1100;
      gzip_buffers 16 8k;
      gzip_proxied any;
      gzip_types
          text/plain
          text/css
          text/js
          text/xml
          text/javascript
          application/javascript
          application/x-javascript
          application/json
          application/xml
          application/rss+xml
          image/svg+xml;
      alias /tdrive-react/build/;
      allow all;
      try_files $uri /index.html;
  }

  location ~ ^/(internal|plugins).* {
      proxy_set_header X-Forwarded-Host $host;
      proxy_pass ${NODE_HOST};
  }

  location ~ ^/(api|administration/v2/).* {
      proxy_set_header X-Forwarded-Host $host;
      proxy_pass ${NODE_HOST};
  }

  location ~ ^/(ajax|api|administration|upload|bundle|medias).* {
      # try to serve file directly, fallback to rewrite
      try_files $uri @rewriteapp;
  }

}