server {
    listen 8543 ssl;
    listen [::]:8543 ssl;
    server_name _;

    ssl_certificate /etc/archipelago/ssl/archipelago.crt;
    ssl_certificate_key /etc/archipelago/ssl/archipelago.key;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

    # Regress needs browser geolocation for its core claim/link mechanic — the
    # main archipelago dashboard's server blocks (80/443) set
    # Permissions-Policy: geolocation=() globally, which would silently break
    # this feature if Regress were proxied under those. This is a dedicated
    # server block on its own port specifically so it isn't subject to that.
    add_header Permissions-Policy "geolocation=(self)" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        proxy_pass http://127.0.0.1:8199;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}