upstream mattermost {
	server		127.0.0.2:8065;
	keepalive 	32;
}

proxy_cache_path 	/var/cache/nginx levels=1:2 keys_zone=mattermost_cache:10m max_size=3g inactive=120m use_temp_path=off;

server {
	listen		81.16.19.64:443 ssl http2;
	listen		192.168.0.110:443 ssl http2;
	server_name	mattermost.casa;

	http2_push_preload	on;

	ssl_certificate			/etc/letsencrypt/live/mattermost.casa/fullchain.pem;
	ssl_certificate_key		/etc/letsencrypt/live/mattermost.casa/privkey.pem;
	ssl_session_timeout		1d;
	ssl_protocols			TLSv1.2 TLSv1.3;
	ssl_early_data			on;
	ssl_ciphers			'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
	ssl_prefer_server_ciphers	on;
	#ssl_session_cache		shared:SSL:50m;
	add_header			Strict-Transport-Security max-age=15768000;
	#add_header			X-Early-Data $tls1_3_early_data;
	ssl_stapling			on;
	ssl_stapling_verify		on;
	resolver			127.0.0.4;

        location			/libcasa/channels/town-square {
           return			https://mattermost.casa/libcasa/channels/libcasa;
	}

	location			~ /api/v[0-9]+/(users/)?websocket$ {
					proxy_set_header 	Upgrade 		$http_upgrade;
					proxy_set_header 	Connection 		"upgrade";
					proxy_set_header	Host 			$http_host;
					proxy_set_header	X-Real-IP 		$remote_addr;
					proxy_set_header	X-Real-IP 		$remote_addr;
					proxy_set_header	X-Forwarded-For		$proxy_add_x_forwarded_for;
					proxy_set_header	X-Forwarded-Proto	$scheme;
					proxy_set_header	X-Frame-Options		SAMEORIGIN;
					client_max_body_size 	50M;
					proxy_buffers		256 16k;
					proxy_buffer_size	16k;
					client_body_timeout	60;
					send_timeout		300;
					lingering_timeout	5;
					proxy_connect_timeout	90;
					proxy_send_timeout	300;
					proxy_read_timeout	90s;
					proxy_http_version	1.1;
					proxy_pass		http://mattermost;
	}

	location			/ {
					proxy_set_header	Connection		"";
					proxy_set_header	Host			$http_host;
					proxy_set_header	X-Real-IP		$remote_addr;
					proxy_set_header	X-Forwarded-For		$proxy_add_x_forwarded_for;
					proxy_set_header	X-Forwarded-Proto	$scheme;
					proxy_set_header	X-Frame-Options		SAMEORIGIN;
					client_max_body_size	50M;
					proxy_buffers		256 16k;
					proxy_buffer_size	16k;
					proxy_read_timeout	600s;
					proxy_cache		mattermost_cache;
					proxy_cache_revalidate	on;
					proxy_cache_min_uses	2;
					proxy_cache_use_stale	timeout;
					proxy_cache_lock	on;
					proxy_http_version	1.1;
					proxy_pass		http://mattermost;
	}
}