apiVersion: v1
data:
  default.conf: |
    server {
        server_name tue.blobfish.ghga-dev.de;

        auth_basic           "Please authenticate";
        auth_basic_user_file /etc/nginx/auth/blobgish.htpasswd;

        client_max_body_size 4g;

        location / {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_pass http://data-portal-ui:8080;
        }

        location  /api/search {
            rewrite /api/search/(.*) /$1  break;
            proxy_pass         http://metadata-search:8080;
            proxy_redirect     off;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $http_host;
        }

        location  /api/repository {
            rewrite /api/repository/(.*) /$1  break;
            proxy_pass         http://metadata-repository:8080;
            proxy_redirect     off;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header Host $http_host;
        }

      #  location /data.zip {
      #      alias /var/www/data.zip;
      #      auth_basic "Please authenticate";
      #      auth_basic_user_file /etc/nginx/auth/data.htpasswd;
      #  }

        listen [::]:443 ssl ipv6only=on;
        listen 443 ssl;
        ssl_certificate /etc/nginx/ssl/fullchain.pem;
        ssl_certificate_key /etc/nginx/ssl/privkey.pem;



        ssl_session_cache shared:le_nginx_SSL:1m;
        ssl_session_timeout 1440m;

        # intermediate configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers on;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
        add_header Strict-Transport-Security "max-age=63072000" always;

    # OCSP stapling
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_dhparam /etc/nginx/ssl/ssl-dhparams.pem;

    }
    server {
        if ($host = tue.blobfish.ghga-dev.de) {
            return 301 https://$host$request_uri;
        } 


        listen 80 default_server;
        listen [::]:80 default_server;

        server_name tue.blobfish.ghga-dev.de;
        return 404;
    }
kind: ConfigMap
metadata:
  name: nginxconfigmap
