kind: ConfigMap
apiVersion: v1
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
  labels:
    app: ingress-nginx
data:
  http-snippet: |
    log_format lm_combined '$remote_addr - $lmremote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';

    server {
      listen 80;
      server_name localhost;
      root /var/www/html;

      location = /reload {
        allow 127.0.0.1;
        deny all;
        include /etc/nginx/fastcgi_params;
        fastcgi_pass localhost:9000;
        fastcgi_param LLTYPE reload;
      }

      location / {
        deny all;
      }

      location = /status {
        allow 127.0.0.1;
        deny all;
        include /etc/nginx/fastcgi_params;
        fastcgi_pass localhost:9000;
        fastcgi_param LLTYPE status;
      }
    }

    server {
      listen 80;
      server_name auth.example.org;
      root /var/lib/lemonldap-ng/portal/;

      location ~ \.pl(?:$|/) {
        include /etc/nginx/fastcgi_params;
        fastcgi_pass localhost:9000;
        fastcgi_param LLTYPE cgi;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        set $sn $request_uri;
        if ($sn ~ "^(.*)\?") {
          set $sn $1;
        }
        if ($sn ~ "^/index.pl") {
          set $sn "/index.pl";
        }
        fastcgi_param SCRIPT_NAME $sn;
        fastcgi_split_path_info ^(.*\.pl)(/.*)$;
        fastcgi_param PATH_INFO       $fastcgi_path_info;
        # Uncomment this if you use Auth SSL:
        #map $ssl_client_s_dn  $ssl_client_s_dn_cn {
        #  default           "";
        #  ~/CN=(?<CN>[^/]+) $CN;
        #}
        #fastcgi_param  SSL_CLIENT_S_DN_CN $ssl_client_s_dn_cn
      }

      #index index.pl;
      rewrite ^/$ /index.pl;

      location / {
        try_files $uri $uri/ =404;

        # Uncomment this if you use https only
        #add_header Strict-Transport-Security "15768000";
      }

      # SOAP functions for sessions management (disabled by default)
      location /index.pl/adminSessions {
        deny all;
      }

      # SOAP functions for sessions access (disabled by default)
      location /index.pl/sessions {
        deny all;
      }

      # SOAP functions for configuration access (disabled by default)
      location /index.pl/config {
        deny all;
      }

      # SOAP functions for notification insertion (disabled by default)
      location /index.pl/notification {
        deny all;
      }
      # SAML2 Issuer
      rewrite ^/saml/metadata /metadata.pl last;
      rewrite ^/saml/.* /index.pl last;

      # CAS Issuer
      rewrite ^/cas/.* /index.pl;

      # OpenID Issuer
      rewrite ^/openidserver/.* /index.pl last;

      # OpenID Connect Issuer
      rewrite ^/oauth2/.* /index.pl last;
      rewrite ^/.well-known/openid-configuration$ /openid-configuration.pl last;

      # Get Issuer
      rewrite ^/get/.* /index.pl;

      # Public pages
      rewrite ^/public.* /public.pl;

      # DEBIAN
      # If install was made with USEDEBIANLIBS (official releases), uncomment this
      #location /javascript/ {
      #  alias /usr/share/javascript/;
      #}
    }
    server {
      listen 80;
      server_name manager.example.org;
      root /usr/share/lemonldap-ng/manager/;

      if ($uri !~ ^/(manager\.psgi|static|doc|fr-doc|lib|javascript|favicon)) {
        rewrite ^/(.*)$ /manager.psgi/$1 break;
      }

      location /manager.psgi {
        include /etc/nginx/fastcgi_params;
        fastcgi_pass localhost:9000;
        fastcgi_param LLTYPE manager;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_split_path_info ^(.*\.psgi)(/.*)$;
        fastcgi_param PATH_INFO  $fastcgi_path_info;
        # Uncomment this if you use https only
        #add_header Strict-Transport-Security "15768000";
      }

      location / {
        index manager.psgi;
        allow 127.0.0.0/8;
        deny all;
        try_files $uri $uri/ =404;
      }

      location /doc/ {
        alias /usr/share/doc/lemonldap-ng-doc/;
        index index.html start.html;
      }
      location /lib/ {
        alias /usr/share/doc/lemonldap-ng-doc/pages/documentation/current/lib/;
      }
      location /fr-doc/ {
        alias /usr/share/doc/lemonldap-ng-fr-doc/;
        index index.html start.html;
      }
      location /static/ {
        alias /usr/share/lemonldap-ng/manager/static/;
      }

      # DEBIAN
      # If install was made with USEDEBIANLIBS (official releases), uncomment this
      #location /javascript/ {
      #  alias /usr/share/javascript/;
      #}

    }
  server-snippet: |
    location = /lmauth {
      internal;
      include /etc/nginx/fastcgi_params;
      fastcgi_pass localhost:9000;
      # To use AuthBasic handler, uncomment this and remove "error_page 401"
      # fastcgi_param LLTYPE authbasic;

      # Drop post datas
      fastcgi_pass_request_body  off;
      fastcgi_param CONTENT_LENGTH "";

      # Keep original hostname
      fastcgi_param HOST $http_host;

      # Keep original request (LLNG server will received /llauth)
      fastcgi_param X_ORIGINAL_URI  $request_uri;
    }
  location-snippet: |
    ##################################
    # CALLING AUTHENTICATION         #
    ##################################
    auth_request /lmauth;
    auth_request_set $lmremote_user $upstream_http_lm_remote_user;
    auth_request_set $lmlocation $upstream_http_location;
    # Uncomment this if CDA is used
    #auth_request_set $cookie_value $upstream_http_set_cookie;
    #add_header Set-Cookie $cookie_value;
    # Remove this for AuthBasic handler
    error_page 401 $lmlocation;

    ##################################
    # PASSING HEADERS TO APPLICATION #
    ##################################
    auth_request_set $authuser $upstream_http_auth_user;
    proxy_set_header Auth-User $authuser;

    # Change cookie header to hide LLNG cookie
    auth_request_set $lmcookie $upstream_http_cookie;
    proxy_set_header Cookie: $lmcookie;
