http {

    # caching for better performance, obeys 'Cache-Control' HTTP headers sent by your poobrains app.
    # to actually use the cache, make sure to uncomment the uwsgi_cache directive in the location block, too!
	#uwsgi_cache_path /var/db/{{ project_name }}-cache keys_zone={{ project_name }}:1M max_size=1G;
	#uwsgi_cache_key $host$request_uri;
	#uwsgi_cache_use_stale updating;

	server {

        # vhost and listening sockets
		server_name {{ domain }};
		listen 80;
		listen 443 ssl;

        # TLS settings. This setup expects you to use certificate and key generated by the 'minica' command.
        ssl_trusted_certificate {{ project_dir }}/tls/cert.pem;
        ssl_certificate {{ project_dir }}/tls/cert.pem;
        ssl_certificate_key {{ project_dir }}/tls/key.pem;
        ssl_client_certificate {{ project_dir }}/tls/cert.pem;
        ssl_verify_client optional;
        ssl_verify_depth 1; # TODO: Wouldn't even 0 work since CA and server cert are the same?
        
        #client_max_body_size 512M; # In case you need to upload bigger feels
        #gzip  on; # Less traffic, more CPU use

		location / {
			root {{ project_dir }};
			include uwsgi_params;
			uwsgi_param SSL_CLIENT_CERT $ssl_client_raw_cert;
			uwsgi_param SSL_CLIENT_VERIFY $ssl_client_verify;
            {% if deployment_os == 'freebsd' %}
			#uwsgi_pass unix:/tmp/{{ project_name }}.sock; # Currently there seems to be a bug with unix sockets in FreeBSD leading to kernel panics
            uwsgi_pass 127.0.0.1:1337;
            {% else %}
            uwsgi_pass unix:/tmp/{{ project_name }}.sock;
            {% endif %}
			#uwsgi_cache {{ project_name }}; # <- Don't forget this one if you want caching.
			#uwsgi_cache_background_update on; # Keep cache up to date (as opposed to empty) even when nobody reads your page
		}
	}
}

