apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx
  namespace: gcsweb
data:
  # Adding new entries here will make them appear as files in the deployment.
  nginx.conf: |
    worker_processes 5;

    events {
    }

    http {
      # Compression
      gzip              on;
      gzip_vary         on;
      gzip_disable      msie6;
      gzip_proxied      any;
      gzip_http_version 1.0;
      gzip_min_length   256;

      # Certs for all SSL server_names.
      ssl_certificate     /certs/tls.crt;
      ssl_certificate_key /certs/tls.key;

      # SSL Session cache
      ssl_session_cache   shared:SSL:10m;
      ssl_session_timeout 18h;

      # Proxy settings
      proxy_http_version      1.1;
      proxy_next_upstream     error timeout http_500 http_502 http_503 http_504;
      proxy_ssl_name          $server_name;
      proxy_ssl_server_name   on;
      proxy_ssl_session_reuse on;
      proxy_ssl_verify_depth  3;

      # Cache settings
      proxy_cache_path              /cache levels=1:2 keys_zone=cache:10m use_temp_path=off;
      proxy_cache_key               $scheme$server_name$request_uri;
      proxy_cache_use_stale         updating error timeout http_500 http_502 http_503 http_504;
      proxy_cache_background_update on;

      # minimal health check
      server {
        server_name istio.io;
        listen 80;
        location = /_healthz {
          add_header Content-Type text/plain;
          return 200 "ok\n";
        }
      }

      # gcsweb.istio.io
      # Upgrade HTTP to HTTPS
      server {
        server_name gcsweb.istio.io;
        listen 80;

        location = /_healthz {
          add_header Content-Type text/plain;
          return 200 "ok\n";
        }

        return 301 https://$server_name$request_uri;
      }

      # Handle HTTPS.
      upstream gcsweb {
        server    gcsweb.gcsweb.svc.cluster.local:80;
        keepalive 10;
      }

      server {
        server_name gcsweb.istio.io;
        listen 443 ssl http2;

        location = /_healthz {
          add_header Content-Type text/plain;
          return 200 "ok\n";
        }

        location / {
          proxy_set_header Host gcsweb.istio.io;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $remote_addr;
          proxy_set_header Connection "";
          proxy_pass       http://gcsweb;

          add_header       X-Cache-Status $upstream_cache_status;
          proxy_cache      off;
        }
      }

      # velodrome.istio.io
      # Upgrade HTTP to HTTPS
      server {
        server_name velodrome.istio.io;
        listen 80;

        location = /_healthz {
          add_header Content-Type text/plain;
          return 200 "ok\n";
        }

        return 301 https://$server_name$request_uri;
      }

      # Handle HTTPS.
      upstream velodrome {
        server    130.211.224.127:80;
        keepalive 10;
      }

      server {
        server_name velodrome.istio.io;
        listen 443 ssl http2;

        location = /_healthz {
          add_header Content-Type text/plain;
          return 200 "ok\n";
        }

        location / {
          proxy_set_header Host velodrome.istio.io;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $remote_addr;
          proxy_set_header Connection "";
          proxy_pass       http://velodrome;

          add_header       X-Cache-Status $upstream_cache_status;
          proxy_cache      off;
        }
      }

      # return 404 for any unknown servers (i.e. subdomains).
      server {
          listen 80 default_server;
          listen 443 ssl http2 default_server;
          server_name _;
          return 404;
      }
    }
