proxy_cache_path  /var/cache/nginx/jellyfin-videos levels=1:2 keys_zone=jellyfin-videos:100m inactive=90d max_size=35000m;
map $request_uri $h264Level { ~(h264-level=)(.+?)& $2; }
map $request_uri $h264Profile { ~(h264-profile=)(.+?)& $2; }

server {
    listen      80;
    listen [::]:80;
    server_name $BASE_URL;

    return 301 https://$host$request_uri;
}

server {
    listen      443 ssl;
    listen [::]:443 ssl;
    server_name $BASE_URL;

    http2 on;

    ssl_certificate     /etc/letsencrypt/live/$BASE_URL/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/$BASE_URL/privkey.pem;

    client_max_body_size 20M;

    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-XSS-Protection "0";
    add_header X-Content-Type-Options "nosniff";

    add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;


    location = / {
        return 302 http://$host/web/;
    }

    location / {
        proxy_pass http://jellyfin:8096;

        proxy_set_header Host                 $host;
        proxy_set_header X-Real-IP            $remote_addr;
        proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto    $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host     $http_host;
        proxy_buffering off;
    }

    location = /web/ {
        proxy_pass http://jellyfin:8096/web/index.html;

        proxy_set_header Host                 $host;
        proxy_set_header X-Real-IP            $remote_addr;
        proxy_set_header X-Forwarded-For      $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto    $scheme;
        proxy_set_header X-Forwarded-Protocol $scheme;
        proxy_set_header X-Forwarded-Host     $http_host;
    }

    location /socket {
        proxy_pass http://jellyfin:8096;

        proxy_http_version 1.1;
        proxy_set_header   Upgrade              $http_upgrade;
        proxy_set_header   Connection           "upgrade";
        proxy_set_header   Host                 $host;
        proxy_set_header   X-Real-IP            $remote_addr;
        proxy_set_header   X-Forwarded-For      $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto    $scheme;
        proxy_set_header   X-Forwarded-Protocol $scheme;
        proxy_set_header   X-Forwarded-Host     $http_host;
    }

    location ~* ^/Videos/(.*)/(?!live) {
      proxy_pass http://jellyfin:8096;

      slice 2m;

      proxy_cache jellyfin-videos;
      proxy_cache_valid 200 206 301 302 30d;
      proxy_ignore_headers Expires Cache-Control Set-Cookie X-Accel-Expires;
      proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
      proxy_connect_timeout 15s;

      proxy_http_version 1.1;
      proxy_set_header   Connection "";
      proxy_set_header   Range      $slice_range;

      proxy_cache_lock on;
      proxy_cache_lock_age 60s;

      proxy_cache_key "jellyvideo$uri?MediaSourceId=$arg_MediaSourceId&VideoCodec=$arg_VideoCodec&AudioCodec=$arg_AudioCodec&AudioStreamIndex=$arg_AudioStreamIndex&VideoBitrate=$arg_VideoBitrate&AudioBitrate=$arg_AudioBitrate&SubtitleMethod=$arg_SubtitleMethod&TranscodingMaxAudioChannels=$arg_TranscodingMaxAudioChannels&RequireAvc=$arg_RequireAvc&SegmentContainer=$arg_SegmentContainer&MinSegments=$arg_MinSegments&BreakOnNonKeyFrames=$arg_BreakOnNonKeyFrames&h264-profile=$h264Profile&h264-level=$h264Level&slicerange=$slice_range";
    }
}