# MANAGED BY PUPPET
server {
  listen       *:443 ssl http2;
  server_name  jenkins;

  ssl on;

  ssl_certificate           /var/private/cert_chain.pem;
  ssl_certificate_key       /var/private/private.key;
  ssl_dhparam               /var/private/dhparam.pem;
  ssl_session_cache         shared:SSL:50m;
  ssl_session_timeout       1d;
  ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers               ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
  ssl_prefer_server_ciphers on;
  ssl_stapling              on;
  ssl_stapling_verify       on;
  ssl_trusted_certificate   /var/private/root_chain.pem;

  resolver                   8.8.8.8 4.4.4.4;
  index  index.html index.htm index.php;

  access_log            /var/log/nginx/jenkins.access.log combined;
  error_log             /var/log/nginx/jenkins.error.log;

  if ( $host != 'jhoblitt-demo-ci.lsst.codes' ) {
    return 301 https://jhoblitt-demo-ci.lsst.codes$request_uri;
  }
  add_header              Strict-Transport-Security 'max-age=15552000';

  location / {

    proxy_pass            http://jenkins;
    proxy_read_timeout    90;
    proxy_connect_timeout 150;
    proxy_redirect        default;
    proxy_set_header      Host            $host;
    proxy_set_header      X-Real-IP       $remote_addr;
    proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
  }

  location /... {
    internal;

    access_log /var/log/nginx/ganglia.access.log;
    error_log /var/log/nginx/ganglia.error.log;
    location ~ ^/\.\.\.(?<p_doc_root>.*)/\.\.\.(?<p_prefix>.*)/\.\.\.(?<p_script>.*\.php)/\.\.\.(?<p_pathinfo>.*)$ {
      fastcgi_pass  127.0.0.1:9000;
      fastcgi_index index.php;
      include fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $p_doc_root$p_script;
      fastcgi_param SCRIPT_NAME     $p_prefix$p_script;
      fastcgi_param REQUEST_URI     $p_prefix$p_script$p_pathinfo$is_args$query_string;
      fastcgi_param DOCUMENT_URI    $p_prefix$p_script$p_pathinfo;
      fastcgi_param DOCUMENT_ROOT   $p_doc_root;
      fastcgi_param PATH_INFO       $p_pathinfo if_not_empty;
    }
  }

  location /ganglia {

    access_log /var/log/nginx/ganglia.access.log;
    alias /usr/share/ganglia;
    error_log /var/log/nginx/ganglia.error.log;
    rewrite ^(/ganglia)(/.*?\.php)(/.*)?$ /...$document_root/...$1/...$2/...$3 last;
  }
}
