# Example nginx server block for estampa.
#
# estampa speaks CGI: when invoked with no arguments it reads
# DOCUMENT_ROOT and DOCUMENT_URI from the env (both populated by
# nginx's stock fastcgi_params) and serves the file at
# $document_root$document_uri as a syntax-highlighted HTML page.
# Files that aren't valid UTF-8 return 404.
#
# Pastes live under the `root` directory below; uploading via scp
# is enough to publish a new paste, and `estampa --run` is what
# expires them (see extras/estampa-ssh).
#
# Requires fcgiwrap (or any CGI-over-FastCGI gateway).

server {
    listen 80;
    server_name paste.example.com;

    # Where pastes live. Change to taste.
    # If this is also the home directory of an upload account (see
    # README), the dotfile guard below is what keeps .ssh/ private.
    root /srv/estampa;

    # Estampa only serves top-level, non-dotfile names. These rules
    # short-circuit obvious misses so the CGI doesn't even fork.
    location ~ /\. { return 404; }   # dotfiles (.ssh/, .bashrc, ...)
    location ~ /.+/ { return 404; }  # anything inside a subdirectory

    location / {
        fastcgi_pass unix:/run/fcgiwrap.socket;
        include fastcgi_params;

        # No wrapper script needed: estampa with no args is the CGI mode.
        fastcgi_param SCRIPT_FILENAME /usr/bin/estampa;
    }
}