server {
  # Nginx versions 1.25+
  listen 443 ssl;
  listen [::]:443 ssl;
  http2 on;

  server_name sage.loadingm.xyz;
  acme_certificate      letsencrypt;
  ssl_certificate       $acme_certificate; 
  ssl_certificate_key   $acme_certificate_key; 
  ssl_certificate_cache max=2;

  ## The default `client_max_body_size` is 1M, this might not be enough for some posters, etc.
  client_max_body_size 200G;

  # Security / XSS Mitigation Headers
  add_header X-Content-Type-Options "nosniff";

  # Permissions policy. May cause issues with some clients
  add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;

  location /grip/ws {
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_connect_timeout 1h;
    proxy_send_timeout 1h;
    proxy_read_timeout 1h;
    proxy_pass http://sage-pushpin:7999/ws;
  }

  # Alias minio in case minio container is not present
  set $minio http://sage-minio:9000;
  location /minio/ {
    rewrite ^/minio/(.*)$ /$1 break;
    proxy_pass $minio;
  }

  location /api/ {
    proxy_pass http://sage-api:3000/;
  }

  location / {
    proxy_pass http://sage-static:80/;
  }
}