
# Internal (IPv4 always; IPv6 optional)
listen 5000;
{{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:5000;{{ end }}{{ end }}


# intended for external traffic, protected by auth
{{ if .tls }}
    {{ if .tls.enabled }}
        # external HTTPS (IPv4 always; IPv6 optional)
        listen 8971 ssl;
        {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971 ssl;{{ end }}{{ end }}

        ssl_certificate /etc/letsencrypt/live/frigate/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/frigate/privkey.pem;

        # generated 2024-06-01, Mozilla Guideline v5.7, nginx 1.25.3, OpenSSL 1.1.1w, modern configuration, no OCSP
        # https://ssl-config.mozilla.org/#server=nginx&version=1.25.3&config=modern&openssl=1.1.1w&ocsp=false&guideline=5.7
        ssl_session_timeout 1d;
        ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
        ssl_session_tickets off;

        # modern configuration
        ssl_protocols TLSv1.3;
        ssl_prefer_server_ciphers off;

        # HSTS (ngx_http_headers_module is required) (63072000 seconds)
        add_header Strict-Transport-Security "max-age=63072000" always;

        # ACME challenge location
        location /.well-known/acme-challenge/ {
                default_type "text/plain";
                root /etc/letsencrypt/www;
        }
    {{ else }}
        # external HTTP (IPv4 always; IPv6 optional)
        listen 8971;
        {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
    {{ end }}
{{ else }}
    # (No tls section) default to HTTP (IPv4 always; IPv6 optional)
    listen 8971;
    {{ if .ipv6 }}{{ if .ipv6.enabled }}listen [::]:8971;{{ end }}{{ end }}
{{ end }}

