sourcehut-docker/nginx_conf/http.d/hg.sr.ht.conf

server {
	include sourcehut.conf;
	include port80.conf;
	server_name hg.localtest.me;

	client_max_body_size 100M;

	location / {
		proxy_pass http://srhts:5010;
		include headers.conf;
		add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src * data:; script-src 'self' 'unsafe-inline'" always;
		include web.conf;
	}

	location /query {
		proxy_pass http://srhts:5110;
		include graphql.conf;
	}

	location /static {
		root /usr/lib/$python/site-packages/hgsrht;
		expires 30d;
	}

	# Let clients reach pull bundles. We don't really need to lock this down even for
	# private repos because the bundles are named after the revision hashes... so someone 
	# would need to guess a SHA value to download anything.
	location ~ ^/[~^][a-z0-9_]+/[a-zA-Z0-9_.-]+/\.hg/bundles/.*$ {
		root /var/lib/mercurial;
	}
}