kind: ConfigMap
apiVersion: v1
metadata:
  name: outer-edge-proxy-config
data:
  nginx.conf: |
    worker_processes 1;
    events {
      worker_connections 2048;
    }

    http {
      include mime.types;
      default_type application/octet-stream;

      gzip on;

      # Get metrics out!
      vhost_traffic_status_zone;

      server {
        listen 127.0.0.1:8001;

        location /status {

          vhost_traffic_status_display;
        }
      }

      map $http_upgrade $connection_upgrade {
          default upgrade;
          '' close;
      }

      map $cookie_cluster $picked_upstream {
        ~^(?P<name>[\w-]+) $name;
      }

      # Create an upstream per cluster. This lets us 'name' our clusters,
      # making it easier to route from nginx based on a cookie.
      {{ range $cluster := .Values.clusterEdges }}
      upstream {{ $cluster.name }} {
        server {{ $cluster.ip }};

        keepalive 64;
      }
      {{ end }}

      # Default upstream that contains the hubsharder
      # Used when a request does not have a cluster cookie set.
      upstream hubsharder {
        server hubsharder.outer-edge.svc.cluster.local;
      }

      # Upstream for homework uploader
      upstream hwuploader {
        server hwuploader.outer-edge.svc.cluster.local;
      }

      server {
        error_log stderr;
        access_log /dev/stdout;

        {{ if .Values.tls.enabled }}
        listen 443 ssl http2 default_server;

        ssl_certificate /etc/nginx/tls/tls.crt;
        ssl_certificate_key /etc/nginx/tls/tls.key;

        ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1;
        ssl_prefer_server_ciphers on;
        ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;

        ssl_session_cache shared:TLS:2m;
        {{ else }}
        listen 80 default_server;
        {{ end }}


        {{ range $cluster := .Values.clusterEdges }}
        location ~ ^/prometheus/{{ $cluster.name }}(?<rest>.*) {
          proxy_set_header Host prometheus.{{ $cluster.name }};

          proxy_pass http://{{ $cluster.ip }}/prometheus/{{ $cluster.name }}$rest$is_args$args;
        }
        {{ end }}

        location /prometheus/misc {
          proxy_pass http://cluster-support-prometheus-server.cluster-support.svc.cluster.local;
        }

        location /grafana/ {
          proxy_set_header   Host $host;

          proxy_pass http://outer-edge-grafana.outer-edge.svc.cluster.local/;
        }

        {{ if .Values.acme.enabled }}
        location = /.well-known/acme-challenge/{{ .Values.acme.fileName }} {
          return 200 "{{ .Values.acme.fileContents }}";
        }
        {{ end }}

        location /hwuploader {
          proxy_pass http://hwuploader;

          # This is required for the target servers to know what
          # exactly the original protocol / URI / Host was.
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Original-URI $request_uri;
          # We explicitly use $http_host rather than $host because we want to
          # preserve the Host headers coming in from the client. $host never
          # includes ports, and causes notebooks to fail a cross origin check,
          # since they check Host vs the Origin.
          proxy_set_header Host $http_host;
        }

        location /hub/lti/launch {
          proxy_pass http://hubsharder;

          # This is required for the target servers to know what
          # exactly the original protocol / URI / Host was.
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Original-URI $request_uri;
          # We explicitly use $http_host rather than $host because we want to
          # preserve the Host headers coming in from the client. $host never
          # includes ports, and causes notebooks to fail a cross origin check,
          # since they check Host vs the Origin.
          proxy_set_header Host $http_host;
        }

        location / {
          proxy_pass http://$picked_upstream$uri$is_args$args;

          # This is required to support websockets
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection $connection_upgrade;

          # This is required for the target servers to know what
          # exactly the original protocol / URI / Host was.
          proxy_set_header X-Forwarded-Proto $scheme;
          proxy_set_header X-Original-URI $request_uri;
          # We explicitly use $http_host rather than $host because we want to
          # preserve the Host headers coming in from the client. $host never
          # includes ports, and causes notebooks to fail a cross origin check,
          # since they check Host vs the Origin.
          proxy_set_header Host $http_host;
        }
      }
    }