apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-default-templates-configmap
data:
  nginx.https.available.conf.template: |
    # NOTE : $VARIABLES are env variables replaced by entrypoint.sh using envsubst
    # not to be mistaken for nginx variables (also starting with $, but usually lowercase)

    # This file is to be included in the main nginx.conf configuration if HTTPS_HOST is set
    # ssl_session_cache   shared:SSL:10m;
    # ssl_session_timeout 10m;

    # this is the actual HTTPS host
    #server {
    #    listen              $HTTPS_PORT ssl;
    #    server_name         $HTTPS_HOST;
    #    keepalive_timeout   70;

    #    ssl_certificate     /certificate_symlink/fullchain.pem;
    #    ssl_certificate_key /certificate_symlink/privkey.pem;
    #    ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
    #    ssl_ciphers         HIGH:!aNULL:!MD5;

    #    include sites-enabled/*.conf;
    #}

    # if we try to connect from http, we redirect to https
    # server {
    #     listen $HTTP_HOST;
    #     server_name $HTTPS_HOST $HTTP_HOST; # TODO : once geoserver supports relative urls, we should allow access though both HTTP and HTTPS at the same time and hence remove HTTP_HOST from this line
        
    #     # Except for let's encrypt challenge
    #     location /.well-known {
    #         alias /geonode-certificates/.well-known;
    #         include  /etc/nginx/mime.types;
    #     }

    #     # Redirect to https
    #     location / {
    #       return 302 https://$HTTPS_HOST$request_uri; # TODO : we should use 301 (permanent redirect, but not practical for debug)
    #     }
    # }

  geonode.conf.template: |
    include /etc/nginx/mime.types;
    # This is the main geonode conf
    charset     utf-8;

    # max upload size
    client_max_body_size 100G;
    client_body_buffer_size 256K;
    large_client_header_buffers 4 64k;
    proxy_read_timeout 600s;

    fastcgi_hide_header Set-Cookie;

    etag on;

    # compression
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_http_version 1.1;
    gzip_disable "MSIE [1-6]\.";
    gzip_buffers 16 8k;
    gzip_min_length 1100;
    gzip_comp_level 6;
    gzip_types
            text/css
            text/javascript
            text/xml
            text/plain
            application/xml
            application/xml+rss
            application/javascript
            application/x-javascript
            application/json;

    # GeoServer
    location /geoserver {

        # Using a variable is a trick to let Nginx start even if upstream host is not up yet
        # (see https://sandro-keil.de/blog/2017/07/24/let-nginx-start-if-upstream-host-is-unavailable-or-down/)
        set $upstream geoserver:8080;

        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_pass http://$upstream;
    }

    # Jenkins
    # location /jenkins {

        # Using a variable is a trick to let Nginx start even if upstream host is not up yet
        # (see https://sandro-keil.de/blog/2017/07/24/let-nginx-start-if-upstream-host-is-unavailable-or-down/)
        # set $upstream jenkins:$JENKINS_HTTP_PORT;
        # set $upstream $HTTP_HOST$HTTPS_HOST:$JENKINS_HTTP_PORT;

        # proxy_set_header Host $http_host;
        # proxy_set_header X-Real-IP $remote_addr;
        # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # proxy_set_header X-Forwarded-Proto $scheme;

        # proxy_pass http://$upstream;
    # }

    # GeoNode
    location /static/ {
      alias /mnt/volumes/statics/static/;

      location ~* \.(?:html|js|jpg|jpeg|gif|png|css|tgz|gz|rar|bz2|doc|pdf|ppt|tar|wav|bmp|ttf|rtf|swf|ico|flv|txt|woff|woff2|svg|xml)$ {
          gzip_static always;
          expires 30d;
          access_log off;
          add_header Pragma "public";
          add_header Cache-Control "max-age=31536000, public";
      }
    }

    location /uploaded/ {
      alias /mnt/volumes/statics/uploaded/;

      location ~* \.(?:html|js|jpg|jpeg|gif|png|css|tgz|gz|rar|bz2|doc|pdf|ppt|tar|wav|bmp|ttf|rtf|swf|ico|flv|txt|woff|woff2|svg|xml)$ {
          gzip_static always;
          expires 30d;
          access_log off;
          add_header Pragma "public";
          add_header Cache-Control "max-age=31536000, public";
      }
    }

    location ~ ^/celery-monitor/? {

        # Using a variable is a trick to let Nginx start even if upstream host is not up yet
        # (see https://sandro-keil.de/blog/2017/07/24/let-nginx-start-if-upstream-host-is-unavailable-or-down/)
        set $upstream celerymonitor:5555;

        rewrite ^/celery-monitor/?(.*)$ /$1 break;

        sub_filter '="/' '="/celery-monitor/';
        sub_filter_last_modified on;
        sub_filter_once off;

        # proxy_pass http://unix:/tmp/flower.sock:/;
        proxy_pass http://$upstream;
        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_http_version 1.1;
    }

    location / {
      # Using a variable is a trick to let Nginx start even if upstream host is not up yet
      # (see https://sandro-keil.de/blog/2017/07/24/let-nginx-start-if-upstream-host-is-unavailable-or-down/)
      set $upstream django:8000;

      if ($request_method = OPTIONS) {
          add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, OPTIONS";
          add_header Access-Control-Allow-Headers "Authorization, Content-Type, Accept";
          add_header Access-Control-Allow-Credentials true;
          add_header Content-Length 0;
          add_header Content-Type text/plain;
          add_header Access-Control-Max-Age 1728000;
          return 200;
      }

      add_header Access-Control-Allow-Credentials false;
      add_header Access-Control-Allow-Headers "Content-Type, Accept, Authorization, Origin, User-Agent";
      add_header Access-Control-Allow-Methods "GET, POST, PUT, PATCH, OPTIONS";

      proxy_connect_timeout       600;
      proxy_send_timeout          600;
      proxy_read_timeout          600;
      send_timeout                600;
      proxy_redirect              off;
      proxy_set_header            Host $host;
      proxy_set_header            X-Real-IP $remote_addr;
      proxy_set_header            X-Forwarded-Host $server_name;
      proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header            X-Forwarded-Proto $scheme;
      proxy_hide_header           X-Frame-Options;

      # uwsgi_params
      include /etc/nginx/uwsgi_params;

      # proxy_pass http://$upstream;
      uwsgi_pass $upstream;

      # when a client closes the connection then keep the channel to uwsgi open. Otherwise uwsgi throws an IOError
      uwsgi_ignore_client_abort on;

      # uwsgi_params
      include /etc/nginx/uwsgi_params;

      location ~* \.(?:js|jpg|jpeg|gif|png|tgz|gz|rar|bz2|doc|pdf|ppt|tar|wav|bmp|ttf|rtf|swf|ico|flv|woff|woff2|svg|xml)$ {
          gzip_static always;
          expires 30d;
          access_log off;
          add_header Pragma "public";
          add_header Cache-Control "max-age=31536000, public";
      }
    }
