##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

#proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=assets:768m use_temp_path=off;

#add_header X-Cache-Status $upstream_cache_status;
#add_header X-Runtime 42;
more_clear_headers 'X-Runtime';
more_clear_headers 'X-Powered-By';
more_clear_headers 'Server';
server_tokens off;

proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=60m use_temp_path=off;

log_format proxy '[$time_local] Cache: $upstream_cache_status $upstream_addr $upstream_response_time $status $bytes_sent $remote_addr $request_uri "$http_referer" "$http_user_agent" $scheme';

limit_req_zone $binary_remote_addr zone=one:20m rate=5r/s;

# Frontend caching and static asset delivery
server {
    listen *:80 default_server;
    listen *:443 ssl;
    ssl_certificate     /etc/letsencrypt/live/screenshots.debian.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/screenshots.debian.net/privkey.pem;

    # Debian SSO based on client certificates
    ssl_client_certificate debsso.crt;
    ssl_crl debsso.crl;
    ssl_verify_client optional;
    ssl_verify_depth 1;

	#root /opt/debshots/public;
	server_name _;
    access_log /var/log/nginx/cache-access.log proxy;

    add_header X-Cache-Status $upstream_cache_status;


    # Pass on the actual HTTP_HOST ("Host:" header) so that Rails can build proper absolute URLs
    proxy_set_header Host $host;
	gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
    gzip_proxied any;

    location / {
        try_files      /maintenance.html @backend;
        add_header X-Coffee front-main;
    }

    location /json/ {
        try_files      /maintenance.html @backend;
        proxy_cache my_cache;
        proxy_pass http://127.0.0.1:3000/;
        proxy_cache_lock on;
        proxy_cache_use_stale updating;
        add_header X-Coffee front-json;
    }

    location /favicon.ico {
        alias /opt/debshots/public/favicon.ico;
    }

    location /.well-known/ {
        alias /opt/debshots/public/.well-known/;
    }

    location @backend {
        proxy_cache my_cache;
        proxy_set_header x_debian_sso_dn $ssl_client_s_dn;
        proxy_pass http://127.0.0.1:3000;
        
        # Tell the backend if the protocol used was HTTPS. Otherwise you get an infinite
        # redirection loop because the backend assumes that HTTP was spoken behind the
        # proxy. And Omniauth would incorrectly assume you used a HTTP callback URL.
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Avoid cache stampede - rather update once and deliver stale content
        proxy_cache_lock on;
        proxy_cache_use_stale updating;
        add_header X-Coffee front-rails;

        # Use sendfile mechanism to deliver files directly
        proxy_set_header X-Sendfile-Type X-Accel-Redirect;
        proxy_set_header X-Accel-Mapping /opt/debshots/public/=/__send_file_accel/;
    }
  
    location /assets/ {
        alias /opt/debshots/public/assets/;
        expires     1h;
        add_header X-Coffee front-assets;
    }
    location /logo/ {
        alias /opt/debshots/public/logo/;
        expires     1h;
        add_header X-Coffee front-logo;
    }
    location /screenshots/ {
        alias /opt/debshots/public/screenshots/;
        expires     max;
        add_header X-Coffee front-screenshots;
    }
    location /images/ {
        alias /opt/debshots/public/images/;
        expires     1h;
        add_header X-Coffee front-images;
    }
}

# Backend rails application
# server {
#     listen 127.0.0.1:3000;

# 	root /opt/debshots/public;

# 	server_name _;
#     access_log /var/log/nginx/rails-access.log;

#     # Send thumbnails using X-Sendfile / X-Accel-Redirect
#     # The correct thumbnail is computed by the Rails application so it cannot be served directly.
#     location /thumbnail/ {
#         expires     1h;
#         proxy_cache_valid 404 15m;
#         add_header X-Coffee back-thumbnail;
#         limit_req zone=one burst=30;
#     }

#     # Send public assets using X-Sendfile / X-Accel-Redirect (e.g. public/images/dummy/...)
#     location /public/ {
#         expires     1h;
#         add_header X-Coffee back-public;

#         # passenger_set_header X-Sendfile-Type X-Accel-Redirect;
#         # passenger_env_var HTTP_X_ACCEL_MAPPING /opt/debshots/public/=/__send_file_accel/;
#         # passenger_pass_header X-Accel-Redirect;
#     }

#     # Deliver static files directly from Nginx. See https://mattbrictson.com/accelerated-rails-downloads
#     location /__send_file_accel/ {
#         internal;
#         alias /opt/debshots/public/;
#         add_header X-Coffee back-accel;
#         expires     1d;
#         more_clear_headers 'Set-Cookie';
#     }

#     location /secretstatus {
#         stub_status;
#         access_log   off;
#         allow all;
#         add_header X-Coffee back-status;
#     }
# }