server {
    listen 8093 ssl http2;
    listen [::]:8093 ssl http2;
    server_name _;

    ssl_certificate     /etc/nginx/ssl/abigail.crt;
    ssl_certificate_key /etc/nginx/ssl/abigail.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 1d;

    root /var/www/abigail;
    index index.html;

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=63072000" always;

    # Gzip
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/javascript application/javascript application/json image/svg+xml;

    # Short URL routes (mirror vercel.json)
    location = /pricing      { try_files /abigail_pricing.html =404; }
    location = /individuals  { try_files /abigail_individuals.html =404; }
    location = /employers    { try_files /abigail_employers.html =404; }
    location = /library      { try_files /abigail_library.html =404; }

    # cleanUrls: serve foo.html when /foo requested
    location / {
        try_files $uri $uri.html $uri/ =404;
    }

    # Deny access to dotfiles
    location ~ /\. {
        deny all;
    }

    # Light caching for HTML, longer for assets if/when added
    location ~* \.(html)$ {
        add_header Cache-Control "public, max-age=300, must-revalidate";
    }
}