server {
    listen 80;
    listen [::]:80;
    server_name connect.portal.hivetechnology.net;

    location ^~ /.well-known/acme-challenge/ {
        root /var/www;
        default_type text/plain;
    }

    location / {
        return 308 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name connect.portal.hivetechnology.net;
    port_in_redirect off;

    ssl_certificate /var/www/certs/cert.pem;
    ssl_certificate_key /var/www/certs/key.pem;

    root /var/www/O20010/O20010.01;
    index index.html;

    add_header Cache-Control "no-store" always;
    add_header Content-Security-Policy "default-src 'none'; img-src 'self'; style-src 'self'; script-src 'self'; connect-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
    add_header Referrer-Policy "no-referrer" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;

    location = / {
        return 302 /vpn/;
    }

    location = /vpn {
        return 308 /vpn/;
    }

    location ^~ /vpn/ {
        try_files $uri $uri/ =404;
    }

    location = /.well-known/assetlinks.json {
        default_type application/json;
        try_files $uri =404;
    }

    location = /.well-known/apple-app-site-association {
        default_type application/json;
        try_files $uri =404;
    }

    location / {
        return 404;
    }
}
