server {
    listen 80;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name taxhacker.app;

    charset utf-8;
    client_max_body_size 256M;

    set_real_ip_from 172.17.0.0/16;
    real_ip_header X-Forwarded-For;
    real_ip_recursive on;

    ssl_certificate     /home/vas3k/certs/pubkey.pem;
    ssl_certificate_key /home/vas3k/certs/privkey.pem;

    # Global security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header X-Frame-Options "DENY" always;
    add_header Permissions-Policy "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()" always;
    add_header Content-Security-Policy "default-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self';" always;

    location / {
        # CORS headers (adjust if needed)
        add_header Access-Control-Allow-Origin "https://taxhacker.app";
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
        add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range";
        add_header Access-Control-Expose-Headers "Content-Length,Content-Range";

        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_redirect off;
        proxy_buffering off;

        proxy_pass http://127.0.0.1:7331;
    }
}