# server {

#             server_name       dobrolom.ru www.dobrolom.ru;
        
#             listen            80;
#             listen [::]:80;

#             add_header Access-Control-Allow-Origin 'https://dobrolom.ru' always;

#             add_header        X-Robots-Tag 'none' always;
#             add_header        Content-Security-Policy "default-src 'self' https: data: 'unsafe-inline'; frame-ancestors 'none'; form-action 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval';" always;

#             etag              off;

#             root              /www/html/maintenance/public/;

#             index             index.html;


#       }

server {

      listen 80;
      listen [::]:80;
      listen 443 quic;
      listen 443 ssl;
      listen [::]:443 ssl;
      listen [::]:443 quic;

      server_name             dobrolom.ru;

      ssl_certificate         /etc/letsencrypt/live/dobrolom.ru/fullchain.pem;
      ssl_certificate_key     /etc/letsencrypt/live/dobrolom.ru/privkey.pem;
      ssl_trusted_certificate /etc/letsencrypt/live/dobrolom.ru/chain.pem;

      # Redirect to the correct place, if needed
      set $https_redirect 0;
      if ($server_port = 80) { set $https_redirect 1; }
      if ($host ~ '^www\.') { set $https_redirect 1; }
      if ($https_redirect = 1) {
      return 301 https://dobrolom.ru$request_uri;
      }

      include /www/nconf/bot_out;

      error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 421 422 423 424 425 426 428 429 431 451 500 501 502 503 504 505 506 507 508 510 511 /error.html;

      location = /error.html {
            limit_req zone=main ;
            ssi on;
            internal;
            auth_basic off;
            root /www/nconf/error;
      }

      root    /www/html/dobrolom.ru/html;

      index index.html;

      add_header Permissions-Policy        "accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=(), geolocation=(self), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(self), usb=()" always;
      add_header X-Frame-Options "SAMEORIGIN" always;
      add_header X-XSS-Protection          "1; mode=block" always;
      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
      add_header Referrer-Policy           "no-referrer-when-downgrade" always;
      add_header Content-Security-Policy  "default-src 'self' https: data: 'unsafe-inline' east-point.site; frame-src 'self'; frame-ancestors 'self'; form-action 'self'; script-src 'self' blob: 'unsafe-inline' 'unsafe-eval';" always;

      location ~* \.(ico|pdf|flv|jpg|jpeg|png|gif|js|css|svg|svgz|eot|otf|woff|mp4|ttf|webp|avif)$ {

          add_header Cache-Control "public, immutable";
          expires max;
          log_not_found off;
          access_log off;
      }


}