user  www-data;

# XXX-Anand: Oct 2013
# Increased the worker_processes to allow more workers to share the load of https.

#worker_processes  1;
worker_processes 4;


error_log  /var/log/nginx/error.log;
pid        /var/run/nginx.pid;

events {
    worker_connections  2048;
    # multi_accept on;
}

http {
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_session_cache   shared:SSL:50m;
    ssl_session_timeout 10m;

    include       /etc/nginx/mime.types;

    server_names_hash_bucket_size   64;
    types_hash_bucket_size 64;

    log_format iacombined '$remote_addr_ipscrub $host $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_time';
    access_log    /var/log/nginx/access.log iacombined;

    client_max_body_size 50m;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;
    tcp_nodelay        on;

    gzip  on;
    gzip_disable "MSIE [1-6]\.(?!.*SV1)";
    gzip_types       text/plain text/css application/x-javascript application/javascript application/xml;

    # Black-listed IPs
    include /olsystem/etc/nginx/deny.conf;

    # Rate limiting: https://nginx.org/en/docs/http/ngx_http_limit_req_module.html
    # No rate limit when IP obfuscation is not applied, as every IP is 255.0.0.0.
    # These rules only do anything if invoked, e.g., in web_nginx.conf.
    # TLDR: these rules can be disabled in `docker/web_nginx.conf`
    # and `docker/covers_nginx.conf`.
    geo $should_apply_limit {
      255.0.0.0 0;
      default 1;
    }

    map $should_apply_limit $rate_limit_key {
      0 '';
      1 $binary_remote_addr;
    }

    limit_req_zone $rate_limit_key zone=web_limit:10m rate=200r/m;
    # Set a more permissive limit for covers because some pages might load 20+ covers.
    limit_req_zone $rate_limit_key zone=cover_limit:10m rate=400r/m;

    # For returning 200 when someone tries to randomly sort author results.
    map $arg_sort $is_random_sort {
      default 0;
      ~^random_.* 1;
    }

    # Things are mounted into here by the docker compose file
    include /etc/nginx/sites-enabled/*;
}
