map $http_upgrade $connection_upgrade {
	default upgrade;
	'' close;
}

server {
	http_status_bypass on;
	listen 80 reuseport default_server backlog=65535;
	listen [::]:80 reuseport default_server backlog=65535;
	root /var/www/html;
	index index.html index.htm;
	server_name _;

	botguard_check off;

	location /.well-known/acme-challenge/ {
		try_files $uri $uri/ @certmanager;
	}

	location @certmanager {
		proxy_pass http://127.0.0.1:8080;
		include proxy_params;
	}

	location = /server-statistics {
		http_status_show server_stat;
	}

	location / {
		add_early_header Link '</res/css/main.min.css?ver=2025021801>; as=style; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/source-sans-pro-v19-latin-ext_latin_greek_cyrillic-700.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/source-sans-pro-v19-latin-ext_latin_greek_cyrillic-regular.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/manrope-v11-latin-ext_latin_greek_cyrillic-700.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/manrope-v11-latin-ext_latin_greek_cyrillic-regular.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '<https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css>; as=style; rel=preload; crossorigin="anonymous"';
		add_early_header Link '<https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Alt-Svc 'h3=":443"; ma=2592000';

		try_files $uri @backend;
	}

	location ~* \.(css|js|map|jpe?g|ico|otf|eot|svg|ttf|txt|html|xml|gz|bz2|zip|lzma|dmg|msi|apk|pdf|gif|png|webp|avif?|mp3|mp4|ogg|webm|woff|woff2)$ {
		try_files $uri @backend;
		expires 1y;
	}

	location = /robots.txt {
		root /var/www/html/res;
		try_files $uri =404;
		expires 1y;
	}

	location = /favicon.ico {
		root /var/www/html/res;
		try_files $uri =404;
		expires 1y;
	}

	location ~ ^/(ws|ev)$ {
		proxy_pass http://127.0.0.1:1620;
		proxy_http_version 1.1;
		proxy_buffering off;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Port $server_port;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
		proxy_read_timeout 900;
		keepalive_timeout 900;
		proxy_socket_keepalive on;
	}

	location @backend {
		proxy_pass http://127.0.0.1:1620;
		include proxy_params;
	}

	# Protect the GK home page from ddos
	error_page 429 @blackhole;

	limit_conn perip 75;
	limit_conn_status 429;
	limit_req zone=faster burst=150 nodelay;
	limit_req_status 429;
	limit_conn_log_level warn;
	limit_req_log_level warn;

	location @blackhole {
		internal;
		include proxy_params;
		proxy_pass http://blackhole;
		proxy_buffering off;
	}
	# /Protect the GK home page from ddos

	include sites-custom/default;
}

server {
	http_status_bypass on;
	listen 443 quic reuseport default_server;
	listen 443 ssl reuseport default_server backlog=65535;
	listen [::]:443 quic ipv6only=on reuseport default_server;
	listen [::]:443 ssl ipv6only=on reuseport default_server backlog=65535;

	http2 on;

	http3 on;
	add_header Alt-Svc 'h3=":443"; ma=2592000';

	root /var/www/html;
	index index.html index.htm;
	server_name _;

	botguard_check off;

	ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
	ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

	location / {
		add_early_header Link '</res/css/main.min.css?ver=2025021801>; as=style; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/source-sans-pro-v19-latin-ext_latin_greek_cyrillic-700.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/source-sans-pro-v19-latin-ext_latin_greek_cyrillic-regular.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/manrope-v11-latin-ext_latin_greek_cyrillic-700.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '</res/fonts/manrope-v11-latin-ext_latin_greek_cyrillic-regular.woff2>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Link '<https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css>; as=style; rel=preload; crossorigin="anonymous"';
		add_early_header Link '<https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0>; as=font; rel=preload; crossorigin="anonymous"';
		add_early_header Alt-Svc 'h3=":443"; ma=2592000';

		try_files $uri @backend;
	}

	location ~* \.(css|js|map|jpe?g|ico|otf|eot|svg|ttf|txt|html|xml|gz|bz2|zip|lzma|dmg|msi|apk|pdf|gif|png|webp|avif?|mp3|mp4|ogg|webm|woff|woff2)$ {
		try_files $uri @backend;
		expires 1y;
	}

	location = /robots.txt {
		root /var/www/html/res;
		try_files $uri =404;
		expires 1y;
	}

	location = /favicon.ico {
		root /var/www/html/res;
		try_files $uri =404;
		expires 1y;
	}

	location ~ ^/(ws|ev)$ {
		proxy_pass http://127.0.0.1:1620;
		proxy_http_version 1.1;
		proxy_buffering off;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header X-Forwarded-Port $server_port;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
		proxy_read_timeout 900;
		keepalive_timeout 900;
		proxy_socket_keepalive on;
	}

	location @backend {
		proxy_pass http://127.0.0.1:1620;
		include proxy_params;
	}

	# Protect the GK home page from ddos
	error_page 429 @blackhole;

	limit_conn perip 75;
	limit_conn_status 429;
	limit_req zone=faster burst=150 nodelay;
	limit_req_status 429;
	limit_conn_log_level warn;
	limit_req_log_level warn;

	location @blackhole {
		internal;
		include proxy_params;
		proxy_pass http://blackhole;
	}
	# /Protect the GK home page from ddos

	include sites-custom/default;
}
