upstream adphone_app {
 zone adphone_app 1m;
 server 127.0.0.1:8001;
 keepalive 16;
}

server {
    listen 443 quic;
    listen 443 ssl;
    http2 on;
    http3 on;
    ssl_protocols       TLSv1.3 TLSv1.2;
    ssl_early_data on;
    add_header Alt-Svc 'h3=":$server_port"; ma=86400';

    server_name             www.adphone.pl adphone.pl;

    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_ecdh_curve secp256r1;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";

    status_zone adphone.pl;
    # SSL
    ssl_certificate         /etc/ssl/adphone.pl/fullchain.pem;
    ssl_certificate_key     /etc/ssl/adphone.pl/privkey.pem;

    # logging
    access_log /var/log/angie/adphone.pl.access.log main;
    error_log  /var/log/angie/adphone.pl.error.log warn;

    if ($host = 'www.adphone.pl') {
        return 301 http://adphone.pl$request_uri;
    }

    if ($request_method !~ ^(GET|HEAD|POST)$) {
        return '405';
    }

    location / {
        proxy_intercept_errors on;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_pass http://adphone_app;
        proxy_request_buffering off;
        client_body_timeout 120s;
        proxy_read_timeout 120s;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_http_version 1.1;
    }

    location /.well-known/acme-challenge/ {
        root /var/www/_letsencrypt/;
        try_files $uri =404;
    }
}

# HTTP redirect
server {
    listen                  80;
    server_name             adphone.pl www.adphone.pl;
    add_header Alt-Svc      'h3=":443"; ma=86400';

    location /.well-known/acme-challenge/ {
        root /var/www/_letsencrypt/;
        try_files $uri =404;
    }
    
    if ($scheme = 'http') {
        return 301 https://adphone.pl$request_uri;
    }
}

# mkdir /etc/ssl/adphone.pl
# acme.sh --issue -d example.com -d www.example.com --webroot /var/www/_letsencrypt/ --cert-file /etc/ssl/adphone.pl/cert.pem --key-file /etc/ssl/adphone.pl/privkey.pem --fullchain-file /etc/ssl/adphone.pl/fullchain.pem