# nginx demo configuration for a ploneintranet site


server {
    listen localhost:80;
    server_name intranet.example.com;

    location / {
        rewrite (.*) https://intranet.example.com$1;
   }
}

server {
    listen localhost:443;
    server_name intranet.example.com;

    ssl on;
    ssl_certificate /etc/ssl/intranet.example.com.crt;
    ssl_certificate_key /etc/ssl/intranet.example.com.key;
    add_header Strict-Transport-Security max-age=31536000;

    client_max_body_size 512m;

    ## Compression
    ## Inspired by https://github.com/h5bp/server-configs-nginx/blob/master/nginx.conf#L67-L109
    gzip              on;
    gzip_disable      "msie6";
    gzip_proxied      any;
    gzip_vary         on;
    gzip_comp_level   5;
    gzip_min_length   256;
    gzip_http_version  1.1;
    gzip_types
        application/atom+xml
        application/x-javascript
        application/javascript
        application/json
        application/ld+json
        application/manifest+json
        application/rss+xml
        application/xml+rss
        application/vnd.geo+json
        application/vnd.ms-fontobject
        application/x-font-ttf
        application/x-web-app-manifest+json
        application/xhtml+xml
        application/xml
        font/opentype
        image/bmp
        image/svg+xml
        image/x-icon
        text/cache-manifest
        text/css
        text/plain
        text/javascript
        text/vcard
        text/vnd.rim.location.xloc
        text/vtt
        text/x-component
        text/x-cross-domain-policy
        text/xml;

    location / {
        # Only allow GET, HEAD, POST and PURGE requests.
        # We also need to allow PUT, LOCK and UNLOCK requests for enabling Zope External Editor
        if ($request_method !~ ^(GET|HEAD|POST|PURGE|PUT|LOCK|UNLOCK)$ ) {
          return 444;
        }

        set $virt_scheme "https";
        if ($http_x_forwarded_proto) {
          set $virt_scheme $http_x_forwarded_proto;
        }
        # Plone
        rewrite ^(.*)$ /VirtualHostBase/$virt_scheme/intranet.example.com/Plone/VirtualHostRoot/$1 break;

        # fall-through (effective when no 'break' rule has been hit)
        return 404;

        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-If-Modified-Since $http_if_modified_since;
        proxy_set_header Connection "";
        proxy_redirect off;
        proxy_intercept_errors on;
 #       Preparation for nicer maintenance pages
 #       error_page 502 /_maintenance/index.html;
 #       error_page 503 /_maintenance/index.html;
   }
}

server {
    listen localhost:80;
    server_name cmsintranet.example.com;

    
    location / {
        rewrite (.*) https://cmsintranet.example.com$1;
   }
}

server {
    listen localhost:443;
    server_name cmsintranet.example.com;

    ssl on;
    ssl_certificate /etc/ssl/intranet.example.com.crt;
    ssl_certificate_key /etc/ssl/intranet.example.com.key;
    add_header Strict-Transport-Security max-age=31536000;

    client_max_body_size 512m;

    ## Compression
    ## Inspired by https://github.com/h5bp/server-configs-nginx/blob/master/nginx.conf#L67-L109
    gzip              on;
    gzip_disable      "msie6";
    gzip_proxied      any;
    gzip_vary         on;
    gzip_comp_level   5;
    gzip_min_length   256;
    gzip_http_version  1.1;
    gzip_types
        application/atom+xml
        application/x-javascript
        application/javascript
        application/json
        application/ld+json
        application/manifest+json
        application/rss+xml
        application/xml+rss
        application/vnd.geo+json
        application/vnd.ms-fontobject
        application/x-font-ttf
        application/x-web-app-manifest+json
        application/xhtml+xml
        application/xml
        font/opentype
        image/bmp
        image/svg+xml
        image/x-icon
        text/cache-manifest
        text/css
        text/plain
        text/javascript
        text/vcard
        text/vnd.rim.location.xloc
        text/vtt
        text/x-component
        text/x-cross-domain-policy
        text/xml;

    location / {
        # Only allow GET, HEAD, POST and PURGE requests.
        # We also need to allow PUT, LOCK and UNLOCK requests for enabling Zope External Editor
        if ($request_method !~ ^(GET|HEAD|POST|PURGE|PUT|LOCK|UNLOCK)$ ) {
          return 444;
        }

        set $virt_scheme "https";
        if ($http_x_forwarded_proto) {
          set $virt_scheme $http_x_forwarded_proto;
        }
        # Plone
        rewrite ^(.*)$ /VirtualHostBase/$virt_scheme/cmsintranet.example.com/Plone/VirtualHostRoot/$1 break;

        # fall-through (effective when no 'break' rule has been hit)
        return 404;

        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Scheme $scheme;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header X-If-Modified-Since $http_if_modified_since;
        proxy_set_header Connection "";
        proxy_redirect off;
        proxy_intercept_errors on;
 #       Preparation for nicer maintenance pages
 #       error_page 502 /_maintenance/index.html;
 #       error_page 503 /_maintenance/index.html;
   }
}

