# /etc/nginx/sites-available/ftp-service.conf

map $query_string $download_hdr {
    ~*(^|&)download($|&|$)  'attachment; filename="$uri"';
    default                 "";
}

# HTTP → HTTPS
server {
    if ($host ~* ^(files\.quan-ng\.uk|files\.techgel\.vn)$) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen       80;
    listen       [::]:80;
    server_name  files.quan-ng.uk files.techgel.vn;
    return       301 https://$host$request_uri;


}

# HTTPS server
server {
    listen              443 ssl http2;
    listen              [::]:443 ssl http2;
    server_name         files.quan-ng.uk files.techgel.vn;
    ssl_certificate /etc/letsencrypt/live/techgel-erp/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/techgel-erp/privkey.pem; # managed by Certbot
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # Serve documents
    location /documents/ {
        alias                     /srv/uploads/ftp-service/erp/documents/;
        autoindex                 on;
        sendfile                  on;
        expires                   1d;
        add_header                X-Content-Type-Options nosniff;
        add_header                Content-Disposition $download_hdr always;
    }

    # Serve image signatures
    location /image-signatures/ {
        alias                     /srv/uploads/ftp-service/erp/image-signatures/;
        autoindex                 on;
        sendfile                  on;
        expires                   1d;
        add_header                X-Content-Type-Options nosniff;
        # apply download header when ?download is present
    }

    location ~ ^/erp/image-signatures/(?<fname>[^/]+)$ {
        alias /srv/uploads/ftp-service/erp/image-signatures/$fname;
        sendfile on;
        expires 1d;
        add_header X-Content-Type-Options nosniff;
        if ($query_string ~* "(^|&)download($|&|$)") {
            add_header Content-Disposition 'attachment; filename="$fname"' always;
        }
    }

    # (Optional) expose everything else
    location / {
        alias                     /;
        autoindex                 on;
        sendfile                  on;
        expires                   1d;
        add_header                X-Content-Type-Options nosniff;
    }


}
