worker_processes 16;

#load_module /usr/lib/nginx/modules/ngx_http_brotli_filter_module.so;
#load_module /usr/lib/nginx/modules/ngx_http_brotli_static_module.so;

events {
    worker_connections  8096;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile            on;
    tcp_nodelay         on;
    tcp_nopush          on;
    server_tokens       off;
    types_hash_max_size 4096;

    client_body_buffer_size       30K;
    client_header_buffer_size     10k;
    client_max_body_size          100m;
    large_client_header_buffers 2 10k;

    client_body_timeout     2400;
    client_header_timeout   2400;
    keepalive_timeout       500;
    send_timeout            2000;

    open_file_cache             max=2000 inactive=20s;
    open_file_cache_valid       60s;
    open_file_cache_min_uses    2;
    open_file_cache_errors      off;

    map $http_accept $webp_suffix {
        default “”;
        “~*webp” “.webp”;
    }

    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    geo $limit {
        default 1;
        #10.0.0.0/8 0;
        #192.168.0.0/24 0;
    }

    map $limit $limit_key {
        0 "";
        1 $binary_remote_addr;
    }

    limit_req_zone $limit_key zone=req_zone:30m rate=500r/s;

    server {
        listen 8080;
        server_name nginx;

        location = /stub_status {
            stub_status;
        }
    }

    server {
        listen 80;
        listen [::]:80 ipv6only=on;
        server_name jaylapp;

        root /var/www/html;
        charset UTF-8;
        # add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' storage.googleapis.com www.googletagmanager.com www.google-analytics.com; img-src 'self' www.googletagmanager.com www.google-analytics.com data:; object-src 'none'";

        location /API/ {
            limit_req zone=req_zone burst=500 nodelay;
            limit_req_status 429;
            proxy_pass http://localhost:8000;
        }

        location /model_viewer/ {

            location ~/(meta|mo3|textures|viewer)/ {
                add_header Access-Control-Allow-Origin "*";
                try_files $uri $uri/;
            }

            location ~/bg.png {
                add_header Access-Control-Allow-Origin "*";
                try_files $uri $uri/;
            }

            proxy_pass http://127.0.0.1:5555;
        }

        location / {
            limit_req zone=req_zone burst=500 nodelay;
            limit_req_status 429;
            proxy_pass http://127.0.0.1:4200;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }

        #return https://$host$request_uri;
    }

    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;
        server_name jaylapp;

        ssl_certificate /etc/nginx/cert/jaylapp.crt;
        ssl_certificate_key /etc/nginx/cert/jaylapp.key.pem;

        ssl_session_cache shared:SSL:20m;
        ssl_session_timeout 60m;

        ssl_prefer_server_ciphers on;
        ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DHE+AES128:!ADH:!AECDH:!MD5;

        ssl_dhparam /etc/nginx/cert/dhparam.pem;

        ssl_protocols TLSv1.3;

        # Live server Only // TODO!
        #ssl_stapling on;
        #ssl_stapling_verify on;
        #ssl_trusted_certificate /etc/nginx/cert/trustchain.crt;
        #resolver 8.8.8.8 8.8.4.4;

        add_header X-Frame-Options "SAMEORIGIN";
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Content-Type-Options nosniff;
        add_header Strict-Transport-Security "max-age=31536000" always;
        add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'; style-src: 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' www.googletagmanager.com www.google-analytics.com; img-src 'self' www.googletagmanager.com www.google-analytics.com data:; object-src 'none'";

        # Hardening
        if ($request_method !~ ^(GET|HEAD|POST)$ )
        {
            return 405;
        }

        # Regular configuration
        root /var/www/html/;
        charset UTF-8;

        # Brotli
        brotli on;
        brotli_static on;
        brotli_types text/plain text/css application/javascript application/json image/svg+xml application/xml+rss;
        brotli_comp_level 6;

        error_page   404              /404.html;
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }

        location ~* .(jpg|jpeg|png|gif|ico|webp|css|js)$ {
            access_log        off;
            log_not_found     off;
            expires           30d;
        }

        location /API/ {
            limit_req zone=req_zone burst=500 nodelay;
            limit_req_status 429;
            proxy_pass http://127.0.0.1:8000;
        }

        location /model_viewer/ {

            location ~(meta|mo3|textures|viewer)/ {
                add_header Access-Control-Allow-Origin "*";
                try_files $uri $uri/ /index.html;
            }

            proxy_pass http://127.0.0.1:5555;
        }

        location / {
            limit_req zone=req_zone burst=500 nodelay;
            limit_req_status 429;
            proxy_pass http://127.0.0.1:4200;
        }
    }

}

#daemon off;