# 部署前必须将域名占位符替换为用户在初始化页面确认的邮件主域名和后台域名。
# 此模板不包含测试域名；不要将未填写的模板直接安装到 Nginx。
# 仅记录请求路径，不记录查询参数、来源页或认证头，避免授权码进入访问日志。
log_format smail_privacy
    '$time_iso8601 remote=$remote_addr method=$request_method uri=$uri '
    'status=$status bytes=$body_bytes_sent duration=$request_time';

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    access_log /var/log/nginx/smail-access.log smail_privacy;
    return 404;
}

server {
    listen 80;
    listen [::]:80;
    server_name __SMAIL_MAIL_DOMAIN__ __SMAIL_WEB_DOMAIN__;
    access_log /var/log/nginx/smail-access.log smail_privacy;

    location ^~ /.well-known/acme-challenge/ {
        root /var/lib/smail-acme;
        default_type text/plain;
        try_files $uri =404;
    }

    location / {
        return 308 https://__SMAIL_WEB_DOMAIN__$request_uri;
    }
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    server_name _;
    access_log /var/log/nginx/smail-access.log smail_privacy;
    ssl_reject_handshake on;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name __SMAIL_MAIL_DOMAIN__;
    access_log /var/log/nginx/smail-access.log smail_privacy;
    ssl_certificate /opt/smail/ssl/custom.crt;
    ssl_certificate_key /opt/smail/ssl/custom.key;
    return 308 https://__SMAIL_WEB_DOMAIN__$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name __SMAIL_WEB_DOMAIN__;
    access_log /var/log/nginx/smail-access.log smail_privacy;
    ssl_certificate /opt/smail/ssl/custom.crt;
    ssl_certificate_key /opt/smail/ssl/custom.key;

    location / {
        proxy_pass https://127.0.0.1:8002;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Connection "";
        proxy_ssl_server_name on;
        proxy_ssl_name __SMAIL_WEB_DOMAIN__;
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 3;
        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
        proxy_connect_timeout 5s;
        proxy_read_timeout 90s;
        proxy_send_timeout 90s;
    }
}