events
{
    worker_connections 1024;
}

http
{
    limit_conn_zone $binary_remote_addr zone=nethack_connections:10m;
    limit_req_zone $binary_remote_addr zone=nethack_requests:10m rate=30r/s;

    upstream nethack_mcp
    {
        server 127.0.0.1:8765;
        keepalive 32;
    }

    server
    {
        listen 80;
        server_name nethack.example;
        return 308 https://nethack.example$request_uri;
    }

    server
    {
        listen 443 ssl;
        server_name nethack.example;

        ssl_certificate /etc/letsencrypt/live/nethack.example/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/nethack.example/privkey.pem;
        server_tokens off;
        client_max_body_size 1m;

        location /
        {
            limit_conn nethack_connections 32;
            limit_req zone=nethack_requests burst=60 nodelay;

            proxy_pass http://nethack_mcp;
            proxy_http_version 1.1;
            proxy_set_header Connection "";
            proxy_read_timeout 30s;
        }
    }
}