user www-data www-data;
pid /var/run/nginx.pid;
worker_processes 1;
worker_rlimit_nofile 21000;

error_log /var/log/error.log;

events {
    worker_connections 12500;
    multi_accept on;
}

http {
    sendfile on;
    # merge_slashes on;
    # tcp_nopush on;
    # tcp_nodelay on;
    # keepalive_timeout 110;
    resolver 192.168.127.10 ipv6=off;
    resolver_timeout 3s;
    log_subrequest on;

    # client_body_temp_path  /client_temp 1 2;
    # proxy_read_timeout 900;
    # proxy_send_timeout 900;
    # types_hash_max_size 2048;
    server_tokens off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    log_format cas_log_format "active\t[ $pid ]\t$remote_addr\t$http_user_agent\t$upstream_http_x_user_identity\t$http_x_client_id\t$http_x_request_id\t$ssl_cipher\t$request_method\t$uri\t$args\t$upstream_http_x_durations\t$status\t$sent_http_x_error_code\t$connection_requests\t$request_completion\t$content_length\t$request_length\t$body_bytes_sent\t$bytes_sent\t$request_time\t$upstream_http_x_worker_pid";
    error_log syslog:server=syslog,tag=nginx,facility=local5 warn;
    access_log syslog:server=syslog,tag=nginx,facility=local6,severity=warn cas_log_format;

    geo $external {
        default            1;
        10.0.0.0/8         0;
        192.0.2.134/32     0;  # us2 VIP SNAT
        192.168.0.0/16     0;  # docker, VIP SNAT
        127.0.0.0/8        0;  # nginx health-checks
        172.16.0.0/12      0;  # tfsbuild
    }

    # http -> https
#    server {
#        listen 80 default_server;
#        location = /robots.txt {
#            alias /var/www/robots.txt;
#        }
#        location / {
#            return 301 https://$host$request_uri;
#        }
#    }

    server {
        #listen 443 ssl;
        listen 80;
        charset utf-8;

        #ssl_certificate /run/secrets/nginx.pem;
        #ssl_certificate_key /run/secrets/nginx.key;
        #ssl_session_timeout 1d;
        #ssl_session_cache shared:SSL:50m;
        #ssl_session_tickets off;#


        # intermediate configuration. tweak to your needs.
        #ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        #ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
        #ssl_prefer_server_ciphers on;

        location /nginx_status {
            stub_status on;
            access_log off;
            if ($external) { return 403; }
        }

        client_max_body_size 100M;

        location /d  {
            client_max_body_size 0;
            proxy_request_buffering off;
            proxy_http_version 1.1;
            proxy_pass  http://upload:8080;
            error_log syslog:server=syslog,tag=upload,facility=local5 warn;
            access_log syslog:server=syslog,tag=upload,facility=local6,severity=warn cas_log_format;
        }

        location  ~ ^/storage/default/(.*):(\d+)/(.*) {
            internal;

            set $download_host $1;
            set $download_port $2;
            set $download_uri $3;

            proxy_method GET;
            proxy_pass_request_headers off;
            proxy_pass_request_body off;
            proxy_buffering off;
            proxy_http_version 1.1;

            proxy_hide_header x-amz-request-id;
            proxy_hide_header x-amz-meta-uid;
            proxy_hide_header x-amz-id-2;
            proxy_hide_header x-amz-meta-mode;
            proxy_hide_header x-amz-meta-mtime;
            proxy_hide_header x-amz-meta-gid;
            proxy_hide_header x-amz-version-id;
            proxy_hide_header x-amz-server-side-encryption;
            proxy_hide_header accept-ranges;

            proxy_hide_header      Set-Cookie;
            proxy_ignore_headers   Set-Cookie;

            proxy_hide_header content-type;

            # Do not touch local disks when proxying
            # content to clients
            proxy_max_temp_file_size 0;

            # Suppress original request headers
            # but support the following:
            proxy_set_header Host $download_host;
            proxy_set_header Range $http_range;

            proxy_pass https://$download_host:$download_port/$download_uri$is_args$args;
            proxy_connect_timeout 10s;
            proxy_next_upstream error timeout http_500 http_502 http_503;

            # A trick with set to temporary variable and add_header which evaluated
            # before the proxy request:
            set $etag $upstream_http_etag;
            set $last_modified $upstream_http_last_modified;
            set $access_control_expose_headers $upstream_http_access_control_expose_headers;
            set $access_control_allow_origin $upstream_http_access_control_allow_origin;

            add_header Etag $etag;
            add_header Last-Modified $last_modified;
            add_header Access-Control-Expose-Headers $access_control_expose_headers;
            add_header Access-Control-Allow-Origin $access_control_allow_origin;

            error_log syslog:server=syslog,tag=s3,facility=local5 warn;
            access_log syslog:server=syslog,tag=s3,facility=local6,severity=warn cas_log_format;
        }

        location /u {
            client_max_body_size 100M;
            proxy_request_buffering off;
            proxy_http_version 1.1;
            proxy_pass  http://upload:8080;
            error_log syslog:server=syslog,tag=upload,facility=local5 warn;
            access_log syslog:server=syslog,tag=upload,facility=local6,severity=warn cas_log_format;
        }

        location /api/v1 {
            uwsgi_pass  app:8080;
            include     /etc/nginx/uwsgi_params;
            error_log syslog:server=syslog,tag=slot,facility=local5 warn;
            access_log syslog:server=syslog,tag=slot,facility=local6,severity=warn cas_log_format;
        }

        location = /robots.txt {
            alias /var/www/robots.txt;
        }
        location /internal/version {
            default_type text/plain;
            alias /var/www/VERSION;
        }
        location /internal/webping {
            default_type text/plain;
            return 200 'SUCCESS';
        }
    }
}