# /etc/nginx/sites-available/ftp-service.conf
server {
    listen 80;
    listen [::]:80;
    server_name files.quan-ng.uk;

    # Redirect all HTTP → HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name files.quan-ng.uk;

    ssl_certificate     /etc/letsencrypt/live/quan-ng.uk/fullchain.pem;   # reuse your cert
    ssl_certificate_key /etc/letsencrypt/live/quan-ng.uk/privkey.pem;
    include             /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;

    # Serve the ftp-service folder here:
    location / {
        alias /srv/uploads/ftp-service/;
        autoindex on;                    # optional
        sendfile   on;
        expires    1d;
        add_header X-Content-Type-Options nosniff;
    }

   # Serve signature
    location /image-signatures/ {
        alias                     /srv/uploads/ftp-service/erp/image-signatures/;
        autoindex                 on;
        sendfile                  on;
        expires                   1d;
        add_header                X-Content-Type-Options nosniff;
        # apply download header when ?download is present

    }
    location ~ ^/erp/image-signatures/(?<fname>[^/]+)$ {
        alias /srv/uploads/ftp-service/erp/image-signatures/$fname;
        sendfile on;
        expires 1d;
        if ($query_string ~* "(^|&)download($|&|$)") {
	        add_header Content-Disposition "attachment; filename=$fname" always;
        	add_header X-Content-Type-Options nosniff;
	}
    }
    # documents serve mọi file (pdf, docx, v.v.)
    location /documents/ {
      alias /srv/uploads/ftp-service/erp/documents/;
      autoindex on;
      sendfile on;
      expires 1d;
      add_header X-Content-Type-Options nosniff;
    }

    location ~ ^/documents/(?<name>[^/]+)$ {
       alias /srv/uploads/ftp-service/erp/documents/$name;
       if ($arg_download) {
        add_header Content-Disposition 'attachment; filename="$name"' always;
       }
       sendfile on;
       expires 1d;
    }
   
}
