#
# Copyright (c) 2015 Glencoe Software, Inc. All rights reserved.
#
# This software is distributed under the terms described by the LICENCE file
# you can find at the root of the distribution bundle, which states you are
# free to use it only for non commercial purposes.
# If the file is missing please request a copy by contacting
# support@glencoesoftware.com.

# Proxy Setups
upstream omeroweb {
    server 127.0.0.1:4080 fail_timeout=0;
}
upstream thumbnail_backend {
    server 127.0.0.1:8080 fail_timeout=0 max_fails=0;
}
upstream image_region_backend {
    server 127.0.0.1:8081 fail_timeout=0 max_fails=0;
}
upstream pixel_buffer_backend {
    server 127.0.0.1:8082 fail_timeout=0 max_fails=0;
}

# Intermediate SSL configuration from https://ssl-config.mozilla.org/#server=nginx&version=1.27.3&config=intermediate&openssl=3.4.0&guideline=5.7
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519:prime256v1:secp384r1;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
ssl_prefer_server_ciphers off;

# see also ssl_session_ticket_key alternative to stateful session cache
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /etc/nginx/ffdhe2048.txt
ssl_dhparam "/etc/nginx/ffdhe2048.txt";

# http container exists solely to redirect to https
# DNS name may need to be configured along with hostname if different
server {
    listen 80;
    listen [::]:80;
    server_name $hostname;
    return 301 https://$server_name$request_uri;
}

# https container
# DNS name may need to be configured along with hostname if different
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    server_name $hostname;
    ssl_certificate /etc/ssl/certs/signed_cert_plus_intermediates.crt;
    ssl_certificate_key /etc/ssl/private/private.key;

    # HSTS (ngx_http_headers_module is required) (63072000 seconds)
    add_header Strict-Transport-Security "max-age=63072000" always;

    sendfile on;
    client_max_body_size 0;
    proxy_intercept_errors on;
    absolute_redirect off;

    # OMERO Plus maintenance page
    location @maintenance_omero {
        root /opt/omero/OMERO.current/etc/templates/error;
        try_files $uri /maintenance.html =502;
    }

    # Thumbnail MS webclient/webgateway uri(s)
    location ~ ^/(webgateway|webclient)/(render_thumbnail|render_birds_eye_view|get_thumbnails)/ {
        proxy_pass http://thumbnail_backend;
    }

    # Image Region MS webclient/webgateway uri(s)
    location ~ ^/(webclient|webgateway)/(render_(thumbnail_ngff|image|image_region|image_region_rdef|image_rdef|shape_mask)|get_thumbnails_ngff|histogram_json|annotation)/ {
        proxy_pass http://image_region_backend;
    }

    # Image Region URI proxy
    location /omero_ms_image_region/ {
        gzip on;
        gzip_min_length 0;
        gzip_proxied any;
        gzip_types application/octet-stream;
        proxy_pass http://image_region_backend;
    }

    # Pixel Buffer MS uri(s)
    location /tile/ {
        proxy_pass http://pixel_buffer_backend;
    }

    # pathviewer static assets
    location /pathviewer/viewer/static {
        alias /opt/omero/OMERO.current/var/static;
    }

    # omeroweb static assets
    location /static {
        alias /opt/omero/OMERO.current/var/static;
    }

    location @proxy_to_app_omero {
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_buffering off;
        error_page 502 =502 @maintenance_omero;

        proxy_pass http://omeroweb;
    }

    location / {
        # checks for static file, if not found proxy to app
        try_files $uri @proxy_to_app_omero;
    }

}

