server {
  listen  443 ssl;
  server_name {{ r.domain_name }};

  ssl_certificate         /etc/letsencrypt/live/{{ r.domain_name }}/fullchain.pem;
  ssl_certificate_key     /etc/letsencrypt/live/{{ r.domain_name }}/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/{{ r.domain_name }}/fullchain.pem;

  ssl_session_cache shared:SSL:50m;
  ssl_session_timeout 5m;
  ssl_stapling on;
  ssl_stapling_verify on;

  access_log syslog:server=unix:/dev/log,nohostname;
  error_log syslog:server=unix:/dev/log,nohostname;

  root {{ r.site_root }}/dist;
  charset utf-8;
  client_max_body_size 10M;
  gzip on;
  gzip_vary on;
  gzip_min_length 1024;
  gzip_proxied any;
  gzip_types
    # text/html is always compressed by HttpGzipModule
    text/css
    text/javascript
    text/xml
    text/plain
    application/javascript
    application/json
    application/xml
    application/rss+xml
    font/truetype
    font/opentype
    image/svg+xml;

  location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_pass http://127.0.0.1:{{ r.service_port }};
  }
  {% if r.open_location %}
  location {{ r.open_location }} {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' '*';
    add_header 'Access-Control-Allow-Headers' '*';
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_pass http://127.0.0.1:{{ r.service_port }};
  }
  {% endif %}
}
