user  www-data;
worker_processes auto;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    # Strange. But found it on google
    server_names_hash_bucket_size 64;
    
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                     '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for"';

    # access_log  /opt/local/var/log/access.log  main;

    sendfile        on;
    keepalive_timeout  65;

    client_max_body_size 0; # disable limit

    # Mediaclue-Pharo Server
    server {

				{% if mediaclue.useSsl %}
				
					listen 443 ssl http2;

					ssl_certificate /etc/letsencrypt/live/{{mediaclue.appDomain}}/fullchain.pem;
					ssl_certificate_key /etc/letsencrypt/live/{{mediaclue.appDomain}}/privkey.pem;
					include /etc/letsencrypt/options-ssl-nginx.conf;
					ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

				{% else %}
					 listen 80;
				{% endif %}

        server_name {{mediaclue.appDomain}} {{mediaclue.appDomain2}};

        root {{mediaclue.installationPath}}/main/web_root;


        # Pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        # For uploader PlUpload
        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            fastcgi_pass unix:/run/php/php7.2-fpm.sock;
        }

        # Preview images, with placeholder if not existent
        location /p/ {
            root {{mediaclue.installationPath}}/main/web_root;
            try_files $uri /img/nopreview-thumbnail.png;
        }

				# Never cache the placeholder thumbnail
				location = /img/nopreview-thumbnail.png {
            root {{mediaclue.installationPath}}/main/web_root;
            expires -1;
            add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0, proxy-revalidate";
				}								

				# Deny access to .ht* files.
				# TODO: Why is this needed?
				location ~ /\.ht {
            deny all;
        }
        

        location / {

						{% if mediaclue.isBeta %}
            	 # BETA TEST
            	 auth_basic           "App Beta-Test";
            	 auth_basic_user_file htpasswd_betatest;
						{% endif %}
            
            root {{mediaclue.installationPath}}/main/web_root;
            try_files $uri @pharo;
        }

				# Reverse proxy to Pharo
        location @pharo {
            expires -1;
            add_header Cache-Control "no-store, no-cache, must-revalidate, max-age=0, proxy-revalidate";
            proxy_pass   http://127.0.0.1:8087;
            proxy_set_header Host            $host;
            proxy_set_header X-Forwarded-For $remote_addr;
        }

        # X-Sendfile for generated files (ZIP, PDF, ...)
        location {{mediaclue.installationPath}}/main/tmp {
            internal;
            root /;
        }

        # X-Sendfile for downloading the original media file
        location {{mediaclue.installationPath}}/main/media_storage {
            internal;
            root /;
        }

				# Custom error page, if Pharo is not running (looks nicer)
				error_page 502 /errors/502.html;

    }

		{% if mediaclue.useSsl %}
    	 # Redirect HTTP->HTTPS
			 server {
         listen     80;
     		 server_name {{mediaclue.appDomain}} {{mediaclue.appDomain2}};
       	 return 301 https://$host$request_uri;
    	}
		{% endif %}


    # Reject access with just the IP. We do not want bots or other dark forces to annoy us
    server {
				listen 80 default_server;

				{% if mediaclue.useSsl %}
				
					listen 443 ssl http2 default_server;

					ssl_certificate /etc/letsencrypt/live/{{mediaclue.appDomain}}/fullchain.pem;
					ssl_certificate_key /etc/letsencrypt/live/{{mediaclue.appDomain}}/privkey.pem;
					include /etc/letsencrypt/options-ssl-nginx.conf;
					ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

				{% endif %}

        server_name _;

        return 444; # Special code from nginx, just fails and does not return anything to caller
    }


}
