apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-conf
data:
  nginx.conf: |
    worker_processes 1;

    events {
      worker_connections 1024;
    }

    http {
      include mime.types;
      server_names_hash_bucket_size 128;
      proxy_ignore_client_abort on;
      client_max_body_size 0;

      {{- if index .Values "kube-prometheus-stack" "enabled" }}
      server {
        listen 127.0.0.1:80;
        location /status {
          stub_status;
          access_log off;
          allow 127.0.0.1;
          deny all;
        }
      }
      {{- end }}

      {{- if hasKey .Values "redirects" }}
      {{- range .Values.redirects }}

      server {
        listen 80;
        {{- if $.Values.requireHttps }}
        listen 443;
        {{- end }}
        server_name {{ .domain }};
        {{- if $.Values.requireHttps }}
        ssl_certificate /ssl/{{ .tlsCertFile }};
        ssl_certificate_key /ssl/{{ .tlsKeyFile }};

        # Proxy acme challenge files.
        location /.well-known/acme-challenge/ {
          alias /static/challenges/;
          try_files $uri =404;
        }
        {{- end }}

        location / {
          {{- if $.Values.requireHttps }}
          return 301 https://{{ $.Values.domain }}$request_uri;
          {{- else }}
          return 301 http://{{ $.Values.domain }}$request_uri;
          {{- end }}
        }
      }

      {{- end }}
      {{- end }}

      {{- if .Values.requireHttps }}
      server {
        listen 80;
        server_name {{ .Values.domain }};
        ssl_certificate /ssl/{{ .Values.tlsCertFile | default "signed_chain.crt" }};
        ssl_certificate_key /ssl/{{ .Values.tlsKeyFile | default "domain.key" }};

        # Proxy acme challenge files.
        location /.well-known/acme-challenge/ {
          alias /static/challenges/;
          try_files $uri =404;
        }

        location / {
          return 301 https://{{ .Values.domain }}$request_uri;
        }
      }
      {{- end }}

      server {
        {{- if .Values.requireHttps }}
        listen 443 ssl http2;
        {{- else }}
        listen 80;
        {{- end }}

        server_name {{ .Values.domain }};

        {{- if .Values.requireHttps }}
        ssl_certificate /ssl/{{ .Values.tlsCertFile | default "signed_chain.crt" }};
        ssl_certificate_key /ssl/{{ .Values.tlsKeyFile | default "domain.key" }};
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
        {{- end }}
        
        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        location ~*phpinfo.php {
          return 404;
        }
        location ~*index.php {
          return 404;
        }
        location ~*elrekt.php {
          return 404;
        }
        location ~*config.php {
          return 404;
        }
        location ~*wp-login.php {
          return 404;
        }
        location ~*phpmyadmin {
          return 404;
        }
        location ~*recordings/theme/main.css {
          return 404;
        }
        location ~*HNAP1 {
          return 404;
        }
        location /favicon.ico {
          alias /static/images/favicon.ico;
          add_header Cache-Control "max-age=3600, must-revalidate";
        }
        location /gnocchi {
          alias /static/gnocchi;
          add_header Cache-Control "max-age=0, must-revalidate";
        }
        location /static {
          alias /static/;
          autoindex off;
          add_header Cache-Control "max-age=0, must-revalidate";
        }
        location /docs {
          alias /static/docs;
          autoindex off;
          add_header Cache-Control "max-age=0, must-revalidate";
        }
        location /media {
          alias /media/;
          autoindex off;
          add_header Cache-Control "max-age=3600, must-revalidate";
          add_header 'Access-Control-Allow-Origin' 'https://www.tatorapp.com' always;
          add_header 'Access-Control-Allow-Headers' 'Authorization' always;

          # Send CORS response from nginx
          if ($request_method = OPTIONS)
          {
            add_header Content-Length 0;
            add_header Content-Type text/plain;
            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
            add_header Access-Control-Allow-Origin 'https://www.tatorapp.com';
            add_header Access-Control-Allow-Headers "Authorization, Content-Type";
            add_header Access-Control-Allow-Credentials true;
            return 200;
          }
          auth_request /auth-project;
        }
        location /media/working
        {
          return 403;
        }
        location /auth-project {
          internal;
          # Allow for long responses.
          proxy_connect_timeout 1200;
          proxy_send_timeout 1200;
          proxy_read_timeout 1200;
          send_timeout 1200;

          proxy_pass http://gunicorn-svc:8000/auth-project;
          proxy_pass_request_body off;
          proxy_set_header Host $host;
          proxy_set_header Content-Length "";
          proxy_set_header X-Original-URI $request_uri;
          proxy_pass_header Authorization;

          proxy_http_version 1.1;
        }
        {{- if .Values.minio.enabled }}
        location /objects/ {
          proxy_pass http://tator-minio:9000/;
        }
        {{- end }}
        {{- if .Values.kibana.enabled }}
        location /logs/ {
          auth_request /auth-admin;
          proxy_pass http://tator-kibana:{{ .Values.kibana.httpPort }}/;
          proxy_redirect off;
          proxy_buffering off;
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection "upgrade";
          proxy_set_header Host $host;
          proxy_set_header Connection "Keep-Alive";
          proxy_set_header Proxy-Connection "Keep-Alive";
        }
        {{- end }}
        location /auth-admin {
          internal;
          proxy_pass http://gunicorn-svc:8000/auth-admin;
          proxy_pass_request_body off;
          proxy_set_header Host $host;
          proxy_set_header Content-Length "";
          proxy_set_header X-Original-URI $request_uri;
          proxy_pass_header Authorization;
        }
        location / {
          # Allow for big REST responses.
          proxy_connect_timeout 1200;
          proxy_send_timeout 1200;
          proxy_read_timeout 1200;
          send_timeout 1200;

          {{- if .Values.maintenance }}
          return 503;
          {{- end }}
          proxy_pass http://gunicorn-svc:8000;

          proxy_redirect off;
          proxy_http_version 1.1;
          proxy_set_header Connection "";
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Host $server_name;
          {{- if .Values.requireHttps }}
          proxy_set_header X-Forwarded-Proto https;
          {{- end }}
          add_header Cache-Control "max-age=0, must-revalidate";

          gzip on;
          gzip_types application/json;
          gzip_min_length 1024;
        }

        {{- if index .Values "kube-prometheus-stack" "enabled" }}
        location /grafana/ {
          auth_request /auth-admin;
          proxy_pass http://tator-grafana/;
          proxy_set_header Host $host;
        }

        location /prometheus/ {
          auth_request /auth-admin;
          proxy_pass http://tator-kube-prometheus-stac-prometheus:9090/;
          proxy_set_header Host $host;
          sub_filter_types text/html;
          sub_filter_once off;
          sub_filter '="/' '="/prometheus/';
          sub_filter 'var PATH_PREFIX = "";' 'var PATH_PREFIX = "/prometheus";';
          rewrite ^/prometheus/?$ /prometheus/graph redirect;
          rewrite ^/prometheus/(.*)$ /$1 break;
        }
        {{- end }}

        error_page 503 /static/maintenance.html;
        # Allow POST on static pages
        error_page 405 =200 $uri;
      }
    }

