ansible-config/roles/hopglass-frontend/templates/nginx-site.j2

{% if hopglass_frontend_tls_crt is defined %}
server {
    server_name map.hamburg.freifunk.net hopglass.hamburg.freifunk.net;
    listen 443 ssl;
    listen [::]:443 ssl;
    ssl_certificate {{ hopglass_frontend_tls_crt }};
    ssl_certificate_key {{ hopglass_frontend_tls_key }};

    include snippets/header-hsts.conf;
    include snippets/no-unsafe-files.conf;

    add_header Referrer-Policy same-origin;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    proxy_hide_header Referrer-Policy;
    proxy_hide_header X-Content-Type-Options;
    proxy_hide_header X-XSS-Protection;

    root {{ hopglass_frontend_path }}/build;
}

{% endif %}
server {
    server_name map.hamburg.freifunk.net hopglass.hamburg.freifunk.net;
    listen 80;
    listen [::]:80;

{% if hopglass_frontend_tls_crt is defined %}
    location / {
        return 302 https://$host$request_uri;
    }
{% else %}
    include snippets/header-security.conf;
    include snippets/no-unsafe-files.conf;

    root {{ hopglass_frontend_path }}/build;
{% endif %}

    include snippets/location-acme.conf;
}