apiVersion: v1
data:
  nginx.conf: |
    server {
        auth_basic "CVMFS Buildbot";
        auth_basic_user_file /opt/.htaccess;

        # Enable SSL and http2
        listen 443 ssl http2 default_server;

        server_name cvmfs-buildbot.icecube.wisc.edu;

        root html;
        index index.html index.htm;

        ssl on;
        ssl_certificate /opt/server.crt;
        ssl_certificate_key /opt/server.key;

        # put a one day session timeout for websockets to stay longer
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 1440m;

        # please consult latest nginx documentation for current secure encryption settings
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
        #

        # force https
        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

        proxy_set_header HOST $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-Host $host;

        # you could use / if you use domain based proxy instead of path based proxy
        location / {
            proxy_pass http://localhost:8010/;
        }
        location /sse/ {
            # proxy buffering will prevent sse to work
            proxy_buffering off;
            proxy_pass http://localhost:8010/sse/;
        }
        # required for websocket
        location /ws {
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_pass http://localhost:8010/ws;
            # raise the proxy timeout for the websocket
            proxy_read_timeout 6000s;
        }
    }
kind: ConfigMap
metadata:
  name: cvmfs-buildbot-nginx-cfg
