# Redirect HTTP → HTTPS (for renewals and browser redirect)
server {
    listen 80;
    server_name results.ivanooo.com;

    # Let’s Encrypt ACME challenge
    location ^~ /.well-known/acme-challenge/ {
        root /home/ubuntu/results;
        default_type "text/plain";
    }

    # Everything else goes to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

# Main HTTPS site
server {
    listen 443 ssl http2;
    server_name results.ivanooo.com;

    # --- SSL certificates from Let's Encrypt ---
    ssl_certificate     /etc/letsencrypt/live/results.ivanooo.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/results.ivanooo.com/privkey.pem;

    # --- Recommended SSL/TLS settings ---
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 1d;

    # (Optional) security headers
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;

    # --- Website root ---
    root /home/ubuntu/results;
    index index.html index.htm;

    # Keep ACME reachable over HTTPS too
    location ^~ /.well-known/acme-challenge/ {
        root /home/ubuntu/results;
        default_type "text/plain";
    }

    # Normal site content
    location / {
        autoindex on;
        autoindex_exact_size off;
        autoindex_localtime on;
        try_files $uri $uri/ =404;
    }
}

