
## Gio and Sam
# added an haproxy to better balance the requests
# between the webnodes
# http://www.openlibrary.org/admin?stats
#
#
# old conf (requests balanced by nginx)
#upstream webnodes {
#    server ol-web1.us.archive.org:8080;
#    server ol-web2.us.archive.org:8080;
#}
#
# using haproxy
upstream webnodes {
    server web_haproxy:7072;
}

# Keep in sync with covers_nginx.conf
server {
    listen 80 default;
    listen [::]:443 ssl http2 ipv6only=on;
    listen 443 ssl http2;
    server_name localhost;

    ssl_certificate /etc/letsencrypt/live/openlibrary.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/openlibrary.org/privkey.pem;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /olsystem/etc/nginx/dhparam-2048.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
}

server {
    listen 80;
    listen 443;
    server_name  openlibrary.org;

    # Set the referrer policy so browsers send referrers to our own servers
    # In July 2020, Chrome changed its default referrer policy so any cross-origin
    # requests only sent the root referrer `/`. Since openlibrary.org
    # has a different "origin" than analytics.archive.org, the full referrer
    # path is not sent. This changes the behavior back to the pre-July 2020 change.
    add_header Referrer-Policy "no-referrer-when-downgrade";

    root        /openlibrary;

    # Show closed-library page on errors.
    error_page 502 /static/status-500.html;
    error_page 500 /static/status-500.html;

    # Anand - Oct 2013
    # Redirect all http URLs except the API calls (ending with .json or /api/*) to https
    set $api_call "$scheme:noapi";
    if ($uri ~ '\.json$') {
        set $api_call "$scheme:api";
    }
    if ($uri ~ '^/api/.*$') {
        set $api_call "$scheme:api";
    }
    if ($api_call = "http:noapi") {
        rewrite ^(.*)$ https://$http_host$1 last;
    }

    # Return 429 errors as JSON.
    error_page 429 = @429;
    location @429 {
      default_type application/json;
      return 429 '{"status": 429, "message": "Too Many Requests. Consider using https://openlibrary.org/developers/dumps."}';
    }

    location / {
        # Web rate limit.
        limit_req zone=web_limit burst=200 nodelay;
        limit_req_status 429;

        if ($http_user_agent ~ (Bytespider) ) {
           return 444;
        }

        proxy_pass http://webnodes;
        proxy_set_header Host $http_host;

        # Gunicorn takes IP from this header
        proxy_set_header X-Forwarded-For $remote_addr;

        # Hack to make the app pick the right url scheme even when the
        # app server is http only.
        proxy_set_header X-Scheme $scheme;

    }

    # Log likely bots caught in /authors random loop.
    location ~* ^/authors/.* {
        # Web rate limit.
        limit_req zone=web_limit burst=200 nodelay;
        limit_req_status 429;

        # randomly sorting will be removed. For now just return 200
        if ($is_random_sort = 1) {
            return 200 "";
        }

        if ($http_user_agent ~ (Bytespider) ) {
            return 444;
        }

        proxy_pass http://webnodes;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Scheme $scheme;
    }

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /openlibrary/static;
    }

    location ~ ^/(images/.*|favicon.ico|robots.txt)$ {
        rewrite ^(.*)$ /static/$1 last;
    }

    location ~ ^/(y_key_[0-9a-f]+.html|LiveSearchSiteAuth.xml)$ {
        root /olsystem/www;
    }

    location ~ ^/static/(docs|tour|sitemaps|jsondumps|images/shelfview|sampledump.txt.gz)(/.*)?$ {
        root /sitemaps;
        autoindex on;
        rewrite ^/static/(.*)$ /$1 break;
    }

    location /static {
       autoindex on;
       expires 1h;
    }

    location /static/build {
        expires max;
    }

    location /index {
        root /sitemaps;
        autoindex on;
    }
}

server {
    listen 80;
    listen 443 ssl;
    server_name www.openlibrary.org *.openlibrary.org;

    rewrite ^(.*)$ http://openlibrary.org$1 permanent;
}
