worker_processes auto;
pid /tmp/nginx.pid;
user tymur999;

events {
    worker_connections 1024;
}

http {
    include mime.types;
    default_type application/octet-stream;

    sendfile        on;
    tcp_nopush     on;
    server_tokens   off;
    keepalive_timeout  65;

    # Enable compression on all routes
    gzip on;
    gzip_vary on;
    gzip_comp_level 5;
    gzip_min_length 256;
    gzip_proxied any;
    gzip_types application/atom+xml text/javascript application/javascript application/json application/manifest+json application/xml font/opentype image/svg+xml text/css text/plain;

    # Core Security Headers (Applies to all routes unless overridden)
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Robots-Tag "index, follow, max-image-preview:large, max-snippet:-1" always;
    add_header X-XSS-Protection "1; mode=block" always;

    server {
        server_name tymur999.com;
        listen 8000;

        root /var/www/html;
        index index.html;

        location / {
            try_files $uri $uri/ /index.html =404;
            # Never cache the entry point so users always get the latest bundle pointers
            add_header Cache-Control "no-cache, no-store, must-revalidate";
        }



        # Static Assets, WebGL/3D Models, and Fonts
        location ~* \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac|gltf|glb|otf|ttf|woff2?)$ {
          try_files $uri =404; # Fail fast on missing assets, do not serve index.html
          access_log off;

          # Aggressive caching for hashed bundle assets
          add_header Cache-Control "public, max-age=31536000, immutable";
        }

        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }
    }
}