# adapted from:
# * debian /etc/nginx/nginx.conf
# * robosats-deploy/compose/nginx/mn.conf.d/local.conf

# user robosats;
worker_processes auto;
pid $NGINX_DIR/nginx.pid;
error_log $NGINX_DIR/error.log;

events {
    worker_connections 1024;
    # multi_accept on;
}

http {
    client_body_temp_path $NGINX_DIR/temp/client_body;
    proxy_temp_path       $NGINX_DIR/temp/proxy;
    fastcgi_temp_path     $NGINX_DIR/temp/fastcgi;
    uwsgi_temp_path       $NGINX_DIR/temp/uwsgi;
    scgi_temp_path        $NGINX_DIR/temp/scgi;

    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;
    server_tokens off;

    # nginx: [emerg] could not build map_hash, you should increase map_hash_bucket_size: 64
    map_hash_bucket_size 4096;

    # server_names_hash_bucket_size 64;
    # server_name_in_redirect off;

    types {
        text/html                             html htm shtml;
        text/css                              css;
        text/xml                              xml;
        image/gif                             gif;
        image/jpeg                            jpeg jpg;
        application/javascript                js;
        application/atom+xml                  atom;
        application/rss+xml                   rss;

        text/mathml                           mml;
        text/plain                            txt;
        text/vnd.sun.j2me.app-descriptor      jad;
        text/vnd.wap.wml                      wml;
        text/x-component                      htc;

        image/avif                            avif;
        image/png                             png;
        image/svg+xml                         svg svgz;
        image/tiff                            tif tiff;
        image/vnd.wap.wbmp                    wbmp;
        image/webp                            webp;
        image/x-icon                          ico;
        image/x-jng                           jng;
        image/x-ms-bmp                        bmp;

        font/woff                             woff;
        font/woff2                            woff2;

        application/java-archive              jar war ear;
        application/json                      json;
        application/mac-binhex40              hqx;
        application/msword                    doc;
        application/pdf                       pdf;
        application/postscript                ps eps ai;
        application/rtf                       rtf;
        application/vnd.apple.mpegurl         m3u8;
        application/vnd.google-earth.kml+xml  kml;
        application/vnd.google-earth.kmz      kmz;
        application/vnd.ms-excel              xls;
        application/vnd.ms-fontobject         eot;
        application/vnd.ms-powerpoint         ppt;
        application/vnd.oasis.opendocument.graphics        odg;
        application/vnd.oasis.opendocument.presentation    odp;
        application/vnd.oasis.opendocument.spreadsheet     ods;
        application/vnd.oasis.opendocument.text            odt;
        application/vnd.openxmlformats-officedocument.presentationml.presentation    pptx;
        application/vnd.openxmlformats-officedocument.spreadsheetml.sheet    xlsx;
        application/vnd.openxmlformats-officedocument.wordprocessingml.document    docx;
        application/vnd.wap.wmlc              wmlc;
        application/wasm                      wasm;
        application/x-7z-compressed           7z;
        application/x-cocoa                   cco;
        application/x-java-archive-diff       jardiff;
        application/x-java-jnlp-file          jnlp;
        application/x-makeself                run;
        application/x-perl                    pl pm;
        application/x-pilot                   prc pdb;
        application/x-rar-compressed          rar;
        application/x-redhat-package-manager  rpm;
        application/x-sea                     sea;
        application/x-shockwave-flash         swf;
        application/x-stuffit                 sit;
        application/x-tcl                     tcl tk;
        application/x-x509-ca-cert            der pem crt;
        application/x-xpinstall               xpi;
        application/xhtml+xml                 xhtml;
        application/xspf+xml                  xspf;
        application/zip                       zip;

        application/octet-stream              bin exe dll;
        application/octet-stream              deb;
        application/octet-stream              dmg;
        application/octet-stream              iso img;
        application/octet-stream              msi msp msm;

        audio/midi                            mid midi kar;
        audio/mpeg                            mp3;
        audio/ogg                             ogg;
        audio/x-m4a                           m4a;
        audio/x-realaudio                     ra;

        video/3gpp                            3gpp 3gp;
        video/mp2t                            ts;
        video/mp4                             mp4;
        video/mpeg                            mpeg mpg;
        video/quicktime                       mov;
        video/webm                            webm;
        video/x-flv                           flv;
        video/x-m4v                           m4v;
        video/x-mng                           mng;
        video/x-ms-asf                        asx asf;
        video/x-ms-wmv                        wmv;
        video/x-msvideo                       avi;
    }

    default_type application/octet-stream;

    access_log $NGINX_DIR/access.log;

    limit_req_zone $binary_remote_addr zone=tenpersec:10m rate=100r/s;

    upstream robosats_gunicorn_rest {
        server 127.0.0.1:$GUNICORN_PORT;
    }

    upstream robosats_daphne_websocket {
        server 127.0.0.1:$DAPHNE_PORT;
    }

    geo $allowed_localIP {
        default 0;
        # 127.0.0.1 1;
        192.168.0.0/16 1;
        # 192.168.x.x 1;
    }

    map $host $allowed_onion {
        default 0;
        # "$ONION_LOCATION" 1;
    }

    server {
        listen $RUNSERVER_PORT;
        server_name robosats.com;
        large_client_header_buffers 4 64k;

        location / {
            root $NGINX_DIR/root;
            try_files $uri $uri/ /index.html =404;
            # try_files /index.html =404;
        }

        location /static {
            set $allow_access 0;
            if ($allowed_localIP = 1) {
                set $allow_access 1;
            }
            if ($allow_access = 0){
                return 403;
            }

            alias $NGINX_DIR/static;
        }

        # tor to web providers (identification files)
        location /.well-known {
            alias $NGINX_DIR/well-known;
        }

        location /api/ {
            # requests are passed to gunicorn
            proxy_pass http://robosats_gunicorn_rest;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_redirect off;
            add_header Onion-Location $ONION_LOCATION$request_uri;
            limit_req zone=tenpersec burst=10;
        }

        location /coordinator {
            set $allow_access 0;
            if ($allowed_localIP = 1) {
                set $allow_access 1;
            }
            if ($allowed_onion = 1) {
                set $allow_access 1;
            }
            if ($allow_access = 0){
                return 403;
            }

            proxy_pass http://robosats_gunicorn_rest;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_redirect off;
            add_header Onion-Location $ONION_LOCATION$request_uri;
        }

        location /ws/ {
            # websockets are passed to daphne
            proxy_pass http://robosats_daphne_websocket;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
            limit_req zone=tenpersec burst=10;
        }

        location /relay {
            proxy_pass http://127.0.0.1:$STRFRY_PORT;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
        }

        location = /favicon.ico {
            alias $NGINX_DIR/favicon.ico;
            access_log off;
            log_not_found off;
        }
    }
}