nginx.conf

server {
    listen 80;
    server_name chuk.chat www.chuk.chat;
    root /usr/share/nginx/html;
    index index.html;

    # Enable gzip compression
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/x-javascript application/xml+rss application/javascript application/json;

    # ──────────────────────────────────────────────────────────
    # Security headers — defined as variables so every location
    # block can emit them via a single include-style pattern.
    # (nginx discards parent add_header when a location block
    # defines its own, so we must repeat them everywhere.)
    # ──────────────────────────────────────────────────────────

    # Redirect root-level pages to /en/ (preserving query params)
    location = /subscription {
        return 301 /en/subscription/$is_args$args;
    }
    location = /pricing {
        return 301 /en/pricing/$is_args$args;
    }
    location = /downloads {
        return 301 /en/downloads/$is_args$args;
    }
    location = /support {
        return 301 /en/support/$is_args$args;
    }
    location = /privacy {
        return 301 /en/privacy/$is_args$args;
    }
    location = /terms {
        return 301 /en/terms/$is_args$args;
    }
    location = /impressum {
        return 301 /en/impressum/$is_args$args;
    }
    location = /faq {
        return 301 /en/faq/$is_args$args;
    }
    location = /cancellation {
        return 301 /en/cancellation/$is_args$args;
    }

    # HTML pages - no caching so deploys are instant
    location ~* \.html$ {
        add_header Cache-Control "no-cache";
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(self)" always;
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://keepandroidopen.org https://js.stripe.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.github.com https://api.stripe.com; frame-src https://js.stripe.com; font-src 'self'; base-uri 'self'; form-action 'self' https://mail.chuk.chat" always;
    }

    # Handle clean URLs - try files with .html extension
    location / {
        add_header Cache-Control "no-cache";
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-XSS-Protection "1; mode=block" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
        add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(self)" always;
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://keepandroidopen.org https://js.stripe.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.github.com https://api.stripe.com; frame-src https://js.stripe.com; font-src 'self'; base-uri 'self'; form-action 'self' https://mail.chuk.chat" always;
        try_files $uri $uri/ $uri/index.html =404;
    }

    # Cache static assets (fingerprinted CSS/JS safe to cache long)
    location ~* \.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|eot)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
        add_header X-Content-Type-Options "nosniff" always;
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    }

    # Error pages
    error_page 404 /en/404.html;
}