# -*- coding: utf-8 -*-
#
# Copyright (C) 2018-2020 CERN.
#
# invenio-app-ils is free software; you can redistribute it and/or modify it
# under the terms of the MIT License; see LICENSE file for more details.

# This nginx configuration defines two servers, one on port 80 and one on port
# 443. All traffic on port 80 is redirect to port 443 on SSL.
#
# Nginx proxies all requests on port 443 to upstream the application server
# which is expected to be running on port 5000.

upstream backend_server {
  server backend:5000 fail_timeout=0;
}

# HTTP server
server {
  # Redirects all requests to https. - this is in addition to HAProxy which
  # already redirects http to https. This redirect is needed in case you access
  # the server directly (e.g. useful for debugging).
  listen 80; # IPv4
  listen [::]:80; # IPv6
  server_name _;
  return 301 https://$host$request_uri;
}

# HTTPS server
server {
  listen 443; # IPv4
  listen [::]:443; # IPv6
  root /usr/share/nginx/html;
  server_name _;
  charset utf-8;
  keepalive_timeout 5;

  # SSL configuration according to best practices from
  # https://mozilla.github.io/server-side-tls/ssl-config-generator/
  ssl on;
  # The provided certificate (test.crt) and private key (test.key) is only for
  # testing and must never be used in production environment.
  ssl_certificate /etc/ssl/certs/test.crt;
  ssl_certificate_key /etc/ssl/private/test.key;
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;

  # Accepted protocols and ciphers
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
  ssl_prefer_server_ciphers on;

  add_header Strict-Transport-Security "max-age=15768000"; # 6 months

  # The request body is sent to the proxied server immediately as it is
  # received

  # proxy_request_buffering off;
  # Sets the HTTP protocol v1.1 for proxying in order to not use the buffer
  # in case of chunked transfer encoding

  # proxy_http_version 1.1;

  # Proxying to the application server
  # Two locations are defined in order to allow large file uploads in the files
  # API without exposing the other parts of the application to receive huge
  # request bodies.
  location ~ ^/(api|account|admin|oauth|_debug_toolbar|ping|schemas)/* {
    uwsgi_pass backend_server;
    include uwsgi_params;
    uwsgi_buffering off;
    uwsgi_request_buffering off;
    uwsgi_param Host $host;
    uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for;
    uwsgi_param X-Forwarded-Proto $scheme;
    # Max upload size (except for files) is set to 100mb as default.
    client_max_body_size 100m;
  }

  location /api {
    uwsgi_pass backend_server;
    include uwsgi_params;
    uwsgi_buffering off;
    uwsgi_request_buffering off;
    uwsgi_param Host $host;
    uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for;
    uwsgi_param X-Forwarded-Proto $scheme;
    # Max upload size (except for files) is set to 100mb as default.
    client_max_body_size 100m;
  }

  location /api/files {
    uwsgi_pass backend_server;
    include uwsgi_params;
    uwsgi_buffering off;
    uwsgi_request_buffering off;
    uwsgi_param Host $host;
    uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for;
    uwsgi_param X-Forwarded-Proto $scheme;
    # Max upload size for files is set to 50GB (configure as needed).
    client_max_body_size 50G;
  }

  location /invenio-assets {
    root /opt/invenio_app_ils/var/instance;
    access_log off;
  }

  # serve index.html for React app without cache
  location / {
    root /usr/share/nginx/html/react-assets;
    try_files $uri /index.html =404;
    add_header Cache-Control "no-store, no-cache, must-revalidate";

    # security
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header Referrer-Policy "no-referrer-when-downgrade";
  }

  # serve static files for React app with cache
  location /static {
    root /usr/share/nginx/html/react-assets;
    expires 1y;
    add_header Cache-Control "public";
    access_log off;
  }
}
