# Auto-generated by Vacuum Wall — do not edit manually
# Domain: {{ domain }}

{% if force_ssl %}
server {
    listen 80;
    listen [::]:80;
    server_name {{ domain }};

    # ACME HTTP-01 challenge
    location /.well-known/acme-challenge/ {
        root {{ acme_webroot }};
    }

    return 301 https://$host$request_uri;
}
{% endif %}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name {{ domain }};

{% if cert %}
{% if cert == "acme" %}
    ssl_certificate     {{ acme_cert_dir }}/fullchain.cer;
    ssl_certificate_key {{ acme_cert_dir }}/{{ domain }}.key;
{% elif cert == "file" %}
    ssl_certificate     {{ cert_path }};
    ssl_certificate_key {{ cert_key_path }};
{% elif cert == "selfsigned" %}
    ssl_certificate     {{ certs_dir }}/{{ domain }}.crt;
    ssl_certificate_key {{ certs_dir }}/{{ domain }}.key;
{% endif %}
{% elif has_management %}
    ssl_certificate     {{ certs_dir }}/{{ domain }}.crt;
    ssl_certificate_key {{ certs_dir }}/{{ domain }}.key;
{% endif %}

    include snippets/vacuum-wall-ssl.conf;

{% if domain_auth %}
    auth_basic           "Restricted";
    auth_basic_user_file {{ domain_auth.htpasswd }};
{% endif %}

{% if not has_management %}
    add_header X-Content-Type-Options     nosniff                         always;
    add_header X-Frame-Options            DENY                            always;
    add_header X-XSS-Protection           "1; mode=block"                 always;
    add_header Referrer-Policy             "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security  "max-age=31536000; includeSubDomains" always;
{% endif %}

{% for ppath, pcfg in paths.items() %}
{% if pcfg.is_websocket %}
    # {{ ppath }} -> {{ pcfg.backend.host }}:{{ pcfg.backend.port }} (WebSocket)
    location {{ ppath }} {
        auth_basic off;
        proxy_pass http://{{ pcfg.backend.host }}:{{ pcfg.backend.port }};
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400s;
        proxy_send_timeout 86400s;
    }
{% else %}
    # {{ ppath }} -> {{ pcfg.backend.host }}:{{ pcfg.backend.port }}
    location {{ ppath }} {
{% if pcfg.auth is none %}
        auth_basic off;
{% elif pcfg.auth is defined %}
        auth_basic           "Restricted";
        auth_basic_user_file {{ pcfg.auth.htpasswd }};
{% endif %}
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
{% if not pcfg.is_management %}
{% for hname, hval in (pcfg.headers or {}).items() %}
        proxy_set_header {{ hname }} {{ hval }};
{% endfor %}
{% endif %}
        proxy_pass {{ pcfg.backend.proto }}://{{ pcfg.backend.host }}:{{ pcfg.backend.port }};
        proxy_http_version 1.1;
        proxy_connect_timeout 30s;
        proxy_send_timeout    60s;
        proxy_read_timeout    60s;
        proxy_buffering       off;
        proxy_set_header Upgrade    $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
{% endif %}
{% endfor %}

{% if has_management %}
    access_log /var/log/nginx/wall_mgmt_access.log;
    error_log  /var/log/nginx/wall_mgmt_error.log  warn;
{% else %}
    access_log /var/log/nginx/{{ domain }}_access.log;
    error_log  /var/log/nginx/{{ domain }}_error.log  warn;
{% endif %}
}