upstream gitea {
	server unix:/run/gitea/sock;
}

server {
	listen 443 ssl http2;
	server_name {{ gitea_fqdn }};

	ssl_prefer_server_ciphers on;
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers 'EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDEA:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA';
	ssl_certificate /etc/nginx/tls/{{ansible_fqdn}}.crt;
	ssl_certificate_key /etc/nginx/tls/{{ansible_fqdn}}.key;
	ssl_dhparam /etc/nginx/tls/{{ansible_fqdn}}.dh;
	ssl_session_timeout 5m;
	add_header Strict-Transport-Security max-age=15768000;
	gzip off;

	root /srv/gitea/public;

	index index.html;
	location / {
		proxy_pass http://gitea/;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header Host $http_host;
		proxy_redirect off;
	}

	error_page 500 502 503 504 /500.html;
	error_page 404 /404.html;
	error_page 422 /422.html;

	#log_not_found on;
	#log_subrequest on;
}