ginxsom/config/ginxsom-local.conf

# Ginxsom Blossom Server nginx configuration
# Local deployment configuration
# Port: 9443 with SSL

server {
    listen 9443 ssl http2;
    server_name localhost;
    
    # SSL configuration
    ssl_certificate /home/teknari/.ssl_for_local_servers/cert.pem;
    ssl_certificate_key /home/teknari/.ssl_for_local_servers/key.pem;
    
    # SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    
    # Security headers
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-XSS-Protection "1; mode=block" always;
    
    # CORS headers for all responses (including error responses)
    add_header Access-Control-Allow-Origin * always;
    add_header Access-Control-Allow-Methods "GET, HEAD, PUT, DELETE, OPTIONS" always;
    add_header Access-Control-Allow-Headers "Authorization, Content-Type, X-SHA-256, X-Content-Type, X-Content-Length" always;
    add_header Access-Control-Max-Age 86400 always;
    
    # Root directory for blob storage
    root /home/teknari/Storage/Blossom;
    
    # Maximum upload size
    client_max_body_size 100M;
    
    # OPTIONS preflight handler
    if ($request_method = OPTIONS) {
        return 204;
    }
    
    # PUT /upload - File uploads
    location = /upload {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
        fastcgi_read_timeout 300s;
        fastcgi_request_buffering off;
        fastcgi_buffering off;
    }
    
    # GET /list/<pubkey> - List user blobs
    location ~ "^/list/([a-f0-9]{64})$" {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # PUT /mirror - Mirror content
    location = /mirror {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # PUT /report - Report content
    location = /report {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # GET /auth - NIP-42 challenges
    location = /auth {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # GET /health - Health check
    location = /health {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # Admin API
    location /api/ {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # Admin interface
    location /admin {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # Blob serving - SHA256 patterns (serve directly from filesystem)
    location ~ "^/([a-f0-9]{64})(\.[a-zA-Z0-9]+)?$" {
        # Handle DELETE via rewrite to internal location
        if ($request_method = DELETE) {
            rewrite ^/(.*)$ /fcgi-delete/$1 last;
        }
        
        # Handle HEAD via rewrite to internal location
        if ($request_method = HEAD) {
            rewrite ^/(.*)$ /fcgi-head/$1 last;
        }
        
        # GET requests - serve directly from filesystem
        if ($request_method != GET) {
            return 405;
        }
        
        try_files /blobs/$1.html /blobs/$1.js /blobs/$1.mjs /blobs/$1.css /blobs/$1.txt /blobs/$1.jpg /blobs/$1.jpeg /blobs/$1.png /blobs/$1.webp /blobs/$1.gif /blobs/$1.pdf /blobs/$1.mp4 /blobs/$1.mp3 /blobs/$1.md =404;
        
        # Cache control for blobs
        add_header Cache-Control "public, max-age=31536000, immutable";
    }
    
    # Internal FastCGI handler for DELETE
    location ~ "^/fcgi-delete/([a-f0-9]{64}).*$" {
        internal;
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
        fastcgi_param REQUEST_URI /$1;
    }
    
    # Internal FastCGI handler for HEAD
    location ~ "^/fcgi-head/([a-f0-9]{64}).*$" {
        internal;
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
        fastcgi_param REQUEST_URI /$1;
    }
    
    # Root endpoint - server info
    location = / {
        include fastcgi_params;
        fastcgi_pass unix:/tmp/ginxsom.sock;
        fastcgi_param SCRIPT_FILENAME /home/teknari/Storage/Blossom/ginxsom;
    }
    
    # Deny access to sensitive files
    location ~ /\.(ht|git|svn) {
        deny all;
    }
}