# {{ ansible_managed }}
# DEFAULT SERVER @ {{ nginx_port|default(80) }} {% if nginx_sslmode|default('enable') != 'disable' %}/ {{ nginx_ssl_port|default(443) }}{% endif %}

# include haproxy admin webui upstream definition
include /etc/nginx/conf.d/haproxy/upstream-*.conf;

server {
    server_name  {{ upstream.domain }}{% if 'domains' in upstream and upstream.domains is sequence %}{% for domain in upstream.domains %} {{ domain }}{% endfor %}{% endif %};
    listen       {{ nginx_port|default(80) }} default_server;
{% if nginx_sslmode|default('enable') != 'disable' %}
    listen       {{ nginx_ssl_port|default(443) }} ssl default_server;
    ssl_certificate     {% if upstream.cert is defined %}{{ upstream.cert }}{% else %}/etc/nginx/conf.d/cert/{{ upstream.domain }}.crt{% endif %};
    ssl_certificate_key {% if upstream.key is defined %}{{ upstream.key }}{% else %}/etc/nginx/conf.d/cert/{{ upstream.domain }}.key{% endif %};
    ssl_session_timeout 5m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
{% endif %}

{% if upstream.auth is defined and upstream.auth | bool %}
    auth_basic "{{ upstream.realm | default('Pigsty Home Auth') }}";
    auth_basic_user_file /etc/nginx/.htpasswd;
{% endif %}

    # Custom error pages
    error_page 404 /404.html;

    proxy_buffering off;
    proxy_request_buffering off;

    # insight workbench
    location /insight/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:{{ workbench_port|default('8080') }};
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # grafana
    location /ui/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:{{ grafana_port|default('3000') }};
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header Origin $scheme://$http_host;
    }

    location /ui/api/live/ {
        auth_basic off;
        proxy_pass http://127.0.0.1:{{ grafana_port|default('3000') }};
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;

    }

    location ~ ^/ui/(vmetrics|vlogs|vtraces|vmalert|haproxy|alertmgr)(.*)$ {
        return 301 /$1$2;
    }

    # vmetrics
    location /vmetrics/ {
        proxy_pass http://127.0.0.1:{{ vmetrics_port|default('8428') }}/;
    }

    # vlogs
    location /vlogs/ {
        proxy_pass http://127.0.0.1:{{ vlogs_port|default('9428') }}/;
    }

    # vtraces
    location /vtraces/ {
        proxy_pass http://127.0.0.1:{{ vtraces_port|default('10428') }}/;
    }

    # vmalert
    location /vmalert/ {
        proxy_pass http://127.0.0.1:{{ vmalert_port|default('8880') }}/;
    }

    # alertmanager
    location /alertmgr/ {
        proxy_pass http://127.0.0.1:{{ alertmanager_port|default('9059') }}/;
    }

    # blackbox_exporter
    location /blackbox/ {
        proxy_pass http://127.0.0.1:{{ blackbox_port|default('9115') }}/;
    }

    # code-server
    location /code/ {
        proxy_pass http://127.0.0.1:{{ code_port|default('8443') }}/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Accept-Encoding gzip;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
        proxy_redirect / /code/;
    }

    # jupyter lab
    location /jupyter/ {
        proxy_pass http://127.0.0.1:{{ jupyter_port|default('8888') }};
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }

    # haproxy admin page
    include /etc/nginx/conf.d/haproxy/location-*.conf;

{% if upstream.certbot is defined and upstream.certbot != '' %}
    location ^~ /.well-known/acme-challenge/ {
        auth_basic off;
        root {{ nginx_home|default('/www') }}/acme;
        try_files $uri =404;
    }
{% endif %}

{% if nginx_exporter_enabled|default(true)|bool %}
    # liveness probe
    location /nginx {
        auth_basic off;
        stub_status on;
        access_log off;
    }
{% endif %}


    # chinese homepage
    location = /zh {
        return 301 /insight;
    }

    # postgres explain visualizer
    location = /pev {
        alias {{ upstream.path|default(nginx_home|default('/www')) }}/pev.html;
        default_type text/html;
    }

    # 404 error page
    location = /404.html {
        alias {{ upstream.path|default(nginx_home|default('/www')) }}/404.html;
        default_type text/html;
        internal;
    }

    # home server
    location = / {
        return 301 /insight;
    }

    # home server
    location / {
        root        {{ upstream.path|default(nginx_home|default('/www')) }};
        index       index.html;
{% if 'index' in upstream and not upstream.index|bool %}
        autoindex   off;
{% else %}
        autoindex   on;
        auth_basic off;
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        directio 1m;
        output_buffers 2 1m;
        aio threads;
        autoindex_exact_size off;
        autoindex_localtime on;
        autoindex_format html;


{% endif %}
    }

{% if upstream.config is defined and upstream.config != '' %}
{{ upstream.config }}
{% endif %}
}