# Must be set in the global scope see: https://forum.nginx.org/read.php?2,152294,152294
# Why this is important especially with Plex as it makes a lot of requests http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5077.html / https://www.peterbe.com/plog/ssl_session_cache-ab
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

# Upstream to Plex
upstream plex_backend {
	# Set this to the IP address that appears in `ifconfig` (NATTED LAN IP or Public IP address) if you want the bandwidth meter in the server status page to work
	server 127.0.0.1:32400;
	keepalive 32;
}

server {
	# Enabling http2 can cause some issues with some devices, see #29 - Disable it if you experience issues
	listen 443 ssl http2; # http2 can provide a substantial improvement for streaming: https://blog.cloudflare.com/introducing-http2/
	listen [::]:443 ssl http2;
	server_name plex.theribbles.org;

	send_timeout 100m; # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause (e.g. Chrome)

	# Faster resolving, improves stapling time. Timeout and nameservers may need to be adjusted for your location Google's have been used here.
	# resolver 8.8.4.4 8.8.8.8 valid=300s;
	# resolver_timeout 10s;


	# Why this is important: https://blog.cloudflare.com/ocsp-stapling-how-cloudflare-just-made-ssl-30/
	ssl_stapling on;
	ssl_stapling_verify on;

	# Plex has A LOT of javascript, xml and html. This helps a lot, but if it causes playback issues with devices turn it off. (Haven't encountered any yet)
	gzip on;
	gzip_vary on;
	gzip_min_length 1000;
	gzip_proxied any;
	gzip_types text/plain text/css text/xml application/xml text/javascript application/x-javascript image/svg+xml;
	gzip_disable "MSIE [1-6]\.";

	# Nginx default client_max_body_size is 1MB, which breaks Camera Upload feature from the phones.
	# Increasing the limit fixes the issue. Anyhow, if 4K videos are expected to be uploaded, the size might need to be increased even more
	client_max_body_size 100M;

	# Forward real ip and host to Plex
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	# When using ngx_http_realip_module change $proxy_add_x_forwarded_for to '$http_x_forwarded_for,$realip_remote_addr'
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
	proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
	proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
	proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;

	# Websockets
	proxy_http_version 1.1;
	proxy_set_header Upgrade $http_upgrade;
	proxy_set_header Connection "Upgrade";

	# Disables compression between Plex and Nginx, required if using sub_filter below.
	# May also improve loading time by a very marginal amount, as nginx will compress anyway.
	# proxy_set_header Accept-Encoding "";

	# Buffering off send to the client as soon as the data is received from Plex.
	proxy_redirect off;
	proxy_buffering off;

	location / {
		# Example of using sub_filter to alter what Plex displays, this disables Plex News.
		# sub_filter ',news,' ',';
		# sub_filter_once on;
		# sub_filter_types text/xml;
		proxy_pass http://plex_backend;
	}

	# PlexPy forward example, works the same for other services.
	# location /plexpy {
	#	proxy_pass http://127.0.0.1:8181;
	#}

	ssl_certificate /etc/letsencrypt/live/theribbles.org/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/theribbles.org/privkey.pem; # managed by Certbot
}



server {
	if ($host = plex.theribbles.org) {
		return 301 https://$host$request_uri;
	} # managed by Certbot


	listen 80;
	listen [::]:80;

	server_name plex.theribbles.org;
	return 404; # managed by Certbot


}