worker_processes auto;
error_log stderr info;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    sendfile on;
    keepalive_timeout 5;
    server_tokens off;

    upstream freva_backend {
        server {{web_server_name}}:8000;
    }

    upstream databrowser_backend {
        server {{web_freva_rest_host}};
    }

    server {
        listen {{web_port_httpsd}} ssl;
        server_name {{web_server_name}};
        root /srv/static/;
        index index.html;

        ssl_certificate /tmp/server-cert.crt;
        ssl_certificate_key /tmp/server-key.key;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256";
        ssl_prefer_server_ciphers on;

        add_header Strict-Transport-Security "max-age=15552000; includeSubdomains;" always;
        add_header X-Frame-Options "SAMEORIGIN";

        location /static/ {
            alias /srv/static/;
        }

        location /robots.txt {
            alias /srv/static/robots.txt;
        }

        location /favicon.ico {
            alias /srv/static/favicon.ico;
        }

        location /under_construction.gif {
            alias /srv/static/under_construction.gif;
        }

        location /api/freva-nextgen {
            proxy_pass http://{{web_freva_rest_host}}/api/freva-nextgen;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
        }

        location /api/databrowser/metadata_search {
            proxy_pass http://{{web_freva_rest_host}}/api/freva-nextgen/databrowser/metadata-search;
        }

        location /api/databrowser/data_search {
            proxy_pass http://{{web_freva_rest_host}}/api/freva-nextgen/databrowser/data-search;
        }

        location /api/freva-data-portal {
            proxy_pass http://{{web_freva_rest_host}}/api/freva-nextgen/data-portal;
        }

        location /api/auth {
            proxy_pass http://{{web_freva_rest_host}}/api/freva-nextgen/auth;
        }

        location / {
            proxy_pass http://{{web_server_name}}:8000/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
        }

        error_log /var/log/web/nginx-error.log;
        access_log /var/log/web/nginx-access.log;
    }
}
