user                                    http;
worker_processes                        auto;

events {
        worker_connections              1024;
}

http {
        server_tokens                   off;
        access_log                      syslog:server=unix:/dev/log;
        error_log                       syslog:server=unix:/dev/log;

        # SSL
        ssl_dhparam                     /etc/ssl/dhparam.pem;
        ssl_certificate                 /etc/letsencrypt/live/DOMAIN/fullchain.pem;
        ssl_certificate_key             /etc/letsencrypt/live/DOMAIN/privkey.pem;
        ssl_session_tickets             off;
        ssl_session_cache               shared:SSL:10m;
        ssl_protocols                   TLSv1.3 TLSv1.2;
        ssl_ciphers                     ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:!AES128;
        ssl_ecdh_curve                  secp521r1:secp384r1;
        ssl_prefer_server_ciphers       on;
        ssl_stapling                    on;
        ssl_stapling_verify             on;
        ssl_trusted_certificate         /etc/letsencrypt/live/DOMAIN/fullchain.pem;
        resolver                        9.9.9.9 1.1.1.1 valid=300s;
        resolver_timeout                10s;
        types_hash_max_size 4096;
        server_names_hash_bucket_size 128;

        ## Security Headers
        add_header                      Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
        add_header                      X-Content-Type-Options nosniff;
        add_header                      X-Frame-Options SAMEORIGIN;
        add_header                      X-XSS-Protection "1; mode=block";
        add_header                      X-Robots-Tag none;
        add_header                      X-Permitted-Cross-Domain-Policies none;
        add_header                      X-Download-Options noopen;

server {
        listen              80;
        server_name             DOMAIN;
        return              301 https://$server_name$request_uri;
}



server {
        include                         mime.types;
        default_type                    application/octet-stream;

        listen                          443 ssl;
        server_name                     DOMAIN;
        server_tokens                   off;
        send_timeout                    10;

        root                            /srv/http/;
        index                           index.php index.html;
        client_max_body_size            10G;
        fastcgi_buffers                 64 16k;
        fastcgi_buffer_size             32k;
        gzip                            off;

        ## Error Page
        error_page 404 /404.html;
        location = /404.html {
                root                    /srv/http;
                internal;
        }

        ## Robot Control
        location = /robots.txt {
                allow                   all;
                log_not_found           off;
                access_log              off;
        }

        ## SABnzbd
        location        /downloads {
                proxy_pass              http://127.0.0.1:7070/downloads;
                proxy_set_header        X-Real-IP  $remote_addr;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
                proxy_redirect          off;
        }


        ## Jellyfin
        #location       /stream/ {
        #       proxy_pass              http://127.0.0.1:8096/stream;
        #       proxy_set_header        X-Real-IP  $remote_addr;
        #       proxy_set_header        Host            $host;
        #       proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        #       proxy_set_header        X-Forwarded-Proto $scheme;
        #       #proxy_redirect         off;
        #}

        location /stream/ {
        # Proxy main Jellyfin traffic

        # The / at the end is significant.
        # https://www.acunetix.com/blog/articles/a-fresh-look-on-reverse-proxy-related-attacks/

        proxy_pass http://127.0.0.1:8096/stream;

        proxy_pass_request_headers on;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;

        # Disable buffering when the nginx proxy gets very resource heavy upon streaming
        proxy_buffering off;
        }

        ## Sonarr
        location        /tv {
                proxy_pass              http://127.0.0.1:8989/tv;
                proxy_set_header        X-Real-IP  $remote_addr;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
        }

        ## Radarr
        location        /movies {
                proxy_pass              http://127.0.0.1:7878/movies;
                proxy_set_header        X-Real-IP  $remote_addr;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
                proxy_http_version      1.1;
                proxy_set_header         Upgrade $http_upgrade;
                proxy_set_header        Connection $http_connection;
        }

        ## Bazarr
        location        /subs {
                proxy_pass              http://127.0.0.1:6767/subs;
                proxy_set_header        X-Real-IP  $remote_addr;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
        }

        ## Hydra
        location        /hydra {
                proxy_pass              http://127.0.0.1:5076/hydra;
                proxy_set_header        X-Real-IP  $remote_addr;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
        }
}
}