<% if @nginx_http_only != '' -%>
<% else -%>
server {
    listen 80;
    listen [::]:80;
    return 301 https://$host$request_uri;
}
<% end -%>

include /etc/nginx/zulip-include/upstreams;

server {
<% if @nginx_http_only != '' -%>
    listen 80;
    listen [::]:80;
<% else -%>
    listen <%= @nginx_listen_port %>;
    listen [::]:<%= @nginx_listen_port %>;

    ssl on;
    ssl_certificate <%= @ssl_dir %>/certs/zulip.combined-chain.crt;
    ssl_certificate_key <%= @ssl_dir %>/private/zulip.key;
<% end -%>

<% if @no_serve_uploads == '' -%>
    location /user_avatars {
        add_header X-Content-Type-Options nosniff;
        add_header Content-Security-Policy "default-src 'none' img-src 'self'";
        include /etc/nginx/zulip-include/uploads.types;
        alias /home/zulip/uploads/avatars;
    }
<% end -%>

    location /local-static {
        alias /home/zulip/local-static;
    }

    include /etc/nginx/zulip-include/certbot;
    include /etc/nginx/zulip-include/app;
}

<% if @nginx_http_only != '' -%>
<% else -%>
server {
    listen 80;
    listen [::]:80;
    return 301 https://$host$request_uri;
}
<% end -%>

include /etc/nginx/zulip-include/upstreams;

server {
<% if @nginx_http_only != '' -%>
    listen 80;
    listen [::]:80;
<% else -%>
    listen <%= @nginx_listen_port %> http2;
    listen [::]:<%= @nginx_listen_port %> http2;

    ssl on;
    ssl_certificate <%= @ssl_dir %>/certs/zulip.combined-chain.crt;
    ssl_certificate_key <%= @ssl_dir %>/private/zulip.key;
<% end -%>

<% if @no_serve_uploads == '' -%>
    location /user_avatars {
        add_header X-Content-Type-Options nosniff;
        add_header Content-Security-Policy "default-src 'none' img-src 'self'";
        include /etc/nginx/zulip-include/uploads.types;
        alias /home/zulip/uploads/avatars;
    }
<% end -%>

    location /local-static {
        alias /home/zulip/local-static;
    }

    include /etc/nginx/zulip-include/certbot;
    include /etc/nginx/zulip-include/app;
}

Enable http2 in on-premise configuration.
nginx: Enable http2 in on-premise configuration.

Signed-off-by: Anders Kaseorg <dfdb7392591db597bc41cf266a9c3bc12a2706e5@zulipchat.com>
