---
kind: ConfigMap
apiVersion: v1
metadata:
  name: ssl-sidecar
  labels:
    app: dataverse
data:
  default.conf: |
    # Adapted from these sources:
    # https://github.com/pbrumblay/tls-sidecar/blob/master/default.conf
    # https://github.com/kubernetes/kubernetes/blob/master/examples/https-nginx/default.conf
    # https://www.nginx.com/resources/admin-guide/nginx-tcp-ssl-termination/
    # https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/
    # https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1d&hsts=false&ocsp=false&guideline=5.4
    server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        # allow large body sizes
        client_max_body_size 120g;

        # increase client body buffer for performance.
        client_body_buffer_size 128k;

        # map these into the nginx container using a volume secret
        ssl_certificate       /etc/nginx/ssl/tls.crt;
        ssl_certificate_key   /etc/nginx/ssl/tls.key;

        # intermediate configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;

        ssl_session_timeout 1d;
        ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
        ssl_session_tickets off;

        access_log /dev/stdout;
        error_log /dev/stdout info;

        merge_slashes off;
        # replace merge_slashes' behavior with "redirect_slashes"
        location ~* "//" {
                rewrite ^(.*)//(.*)$ $1/$2;
                rewrite ^ $uri permanent;
        }

        location / {
            # proxy to upstream application
            proxy_pass http://127.0.0.1:8080;

            # don't use http 1.0 so keepalive enabled by default
            proxy_http_version 1.1;

            # prevent client from closing keepalive
            proxy_set_header Connection "";

            # don't need timeouts for process to process communication
            # (why complicate things with this MITM proxy? let client timeout)
            proxy_send_timeout 86400s;
            proxy_read_timeout 86400s;

            # don't write client body to docker file system
            proxy_request_buffering off;
        }

        location ~ ^/(logos|branding)/ {
          root /docroot;
          rewrite "^(.*);jsessionid=(.*)$" $1 last;
          try_files $uri =404;
        }
     }
