user nginx;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    upstream read-write {
        server 127.0.0.1:4001;
    }

    upstream ocsp-responder {
        server 127.0.0.1:5001;
    }

    upstream builder {
        server 127.0.0.1:7001;
    }
    
    upstream event {
        server 127.0.0.1:8001;
    }

    resolver 127.0.0.11;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ##
    # SSL Settings
    ##
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    ##
    # Gzip Settings
    ##
    gzip on;

    # Basic DoS prevention measures
    limit_conn addr 100;
    client_body_timeout 5s;
    client_header_timeout 5s;
    limit_conn_zone $binary_remote_addr zone=addr:10m;

    # Backend configuration
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-SSL-CERT $ssl_client_cert;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_connect_timeout 600;
    proxy_send_timeout 600;
    proxy_read_timeout 600;
    send_timeout 600;

    server {
        # Section for serving insecure HTTP, note that this is suitable for
        # OCSP, CRL-s etc which is already covered by PKI protection mechanisms.

        listen 80 default_server;

        # Proxy pass OCSP responder
        location /api/ocsp/ {
            proxy_pass http://ocsp-responder;
        }

        # Event server
        location /api/event/ {
            proxy_buffering off;
            proxy_cache off;
            proxy_pass http://event;
        }

        # Proxy pass to backend
        location /api/ {
            proxy_pass http://read-write;
        }
    }

    server {
        # Section for accessing web interface over HTTPS
        listen 127.0.0.1:1443 ssl http2 default_server;

        # HSTS header below should make sure web interface will be accessed over HTTPS only
        # once it has been configured
        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";

        # Bind mount this directory to use Let's Encrypt keypair for frontend
        ssl_certificate /frontend-secrets/fullchain.pem;
        ssl_certificate_key /frontend-secrets/privkey.pem;

        #proxy pass event
        location /api/event/ {
            proxy_buffering off;
            proxy_cache off;
            proxy_pass http://event;
        }

        #Proxy pass longpoll
        location /api/longpoll/ {
            proxy_buffering off;
            proxy_cache off;
            proxy_pass http://event;
        }

        # OpenWrt image builder
        location /api/build/ {
            proxy_pass http://builder;
        }

        # Proxy pass to backend
        location /api/ {
            proxy_pass http://read-write;
        }

        # This is for Let's Encrypt enroll/renewal
        location /.well-known/ {
            alias /var/www/html/.well-known/;
        }
    }


    server {
        # Section for certificate authenticated HTTPS clients,
        # for submitting information to CA eg. leases,
        # for delivering scripts to clients,
        # for exchanging messages over WebSockets
        server_name $hostname;
        listen 8443 ssl http2;

        # Enforce OCSP stapling for the server certificate
        # Note that even nginx 1.14.0 doesn't immideately populate the OCSP cache
        # You need to run separate cronjob to populate the OCSP response cache
        ssl_stapling on;
        ssl_stapling_verify on;

        # Allow client authentication with certificate,
        # backend must still check if certificate was used for TLS handshake
        ssl_verify_client optional;
        ssl_client_certificate /server-secrets/ca_cert.pem;

        # Use same keypair used by IPSec, OpenVPN
        ssl_certificate /server-secrets/self_cert.pem;
        ssl_certificate_key /server-secrets/self_key.pem;

        # Proxy pass to backend
        location /api/ {
            proxy_pass http://read-write;
        }
    }
}