`deploy/sound.agentabrams.com.nginx`

26 lines
# sound.agentabrams.com — Agent Abrams SoundLab (public static sound hub)
# HTTP-only BOOTSTRAP conf: nginx -t must pass on a first deploy BEFORE any cert
# exists so certbot's HTTP-01 challenge can complete. `certbot --nginx` (deploy.sh
# step 4) then injects the `listen 443 ssl` block, the ssl_certificate lines, and
# the 80->443 redirect itself. Do NOT hardcode ssl_certificate paths here — that
# reintroduces the bootstrap deadlock (nginx -t fails on the missing cert before
# certbot ever runs, and set -euo pipefail aborts the whole deploy).
server {
    listen 45.61.58.125:80;
    server_name sound.agentabrams.com;

    access_log /var/log/nginx/sound.agentabrams.com.access.log;
    error_log /var/log/nginx/sound.agentabrams.com.error.log;

    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    root /var/www/sound.agentabrams.com;
    index index.html;
    autoindex off;

    location / {
        try_files $uri $uri/ $uri.html =404;
    }
}