# ── vandes-web.com — Site vitrine statique ──────────────────────────────────
# Chemin : /etc/nginx/sites-available/vandes-web.com
# Activer : ln -s /etc/nginx/sites-available/vandes-web.com /etc/nginx/sites-enabled/

server {
    listen 80;
    server_name vandes-web.com www.vandes-web.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name vandes-web.com www.vandes-web.com;

    # SSL (généré par : certbot --nginx -d vandes-web.com -d www.vandes-web.com)
    ssl_certificate     /etc/letsencrypt/live/vandes-web.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vandes-web.com/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/vandes-web.com;
    index index.html;

    # Pas d'accès à des fichiers cachés
    location ~ /\. {
        deny all;
    }

    # Pages statiques
    location / {
        try_files $uri $uri/ $uri.html =404;
    }

    # Cache navigateur pour assets
    location ~* \.(css|js|jpg|jpeg|png|gif|svg|ico|woff2?)$ {
        expires 30d;
        add_header Cache-Control "public, no-transform";
    }

    # En-têtes de sécurité
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self' https://admin.vandes-web.com;" always;

    # Cacher la version Nginx
    server_tokens off;
}