proxy_http_version 1.1;
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $remote_addr;
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Accept-Encoding   "";
proxy_buffering on;
proxy_request_buffering off;
proxy_read_timeout 300s;
proxy_connect_timeout 30s;

# Docker embedded DNS, pinned to bypass image-specific resolv.conf order.
resolver 127.0.0.11 ipv6=off valid=30s;

# Nexus answers 502 when a proxy's remote is unreachable (measured) and has no
# group repository type for apt, so the mirror failover sits here rather than in
# the repo layout. 5xx only: a 404 means the file genuinely is not in the suite,
# and apt probes for missing files often enough that retrying those would double
# the request rate.
#
# Nexus answers that 502 only after trying every address of the remote in turn,
# one connect timeout each; for a remote with several addresses that outlasts a
# client's own timeout before the mirror is ever asked.
#
# These stay prefix locations. A regex location forfeits nginx's implicit
# `/debian` -> `/debian/` redirect, and the URL-reachability test probes exactly
# that slash-less form through the runner's DNS hijack, so it turns into a 404.
server {
	listen 80;
	server_name deb.debian.org;
	location /debian/ {
		rewrite ^/debian/(.*)$ /repository/apt-debian/$1 break;
		proxy_intercept_errors on;
		proxy_read_timeout 8s;
		error_page 502 503 504 = @debian_mirror;
		proxy_pass http://package-cache:8081;
	}
	location @debian_mirror {
		rewrite ^/repository/apt-debian/(.*)$ /repository/apt-debian-mirror/$1 break;
		proxy_pass http://package-cache:8081;
	}
	location /debian-security/ {
		rewrite ^/debian-security/(.*)$ /repository/apt-debian-security/$1 break;
		proxy_intercept_errors on;
		proxy_read_timeout 8s;
		error_page 502 503 504 = @debian_security_mirror;
		proxy_pass http://package-cache:8081;
	}
	location @debian_security_mirror {
		rewrite ^/repository/apt-debian-security/(.*)$ /repository/apt-debian-security-mirror/$1 break;
		proxy_pass http://package-cache:8081;
	}
}

server {
	listen 80;
	server_name archive.ubuntu.com;
	location /ubuntu/ {
		rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu/$1 break;
		proxy_intercept_errors on;
		proxy_read_timeout 8s;
		error_page 502 503 504 = @ubuntu_mirror;
		proxy_pass http://package-cache:8081;
	}
	location @ubuntu_mirror {
		rewrite ^/repository/apt-ubuntu/(.*)$ /repository/apt-ubuntu-mirror/$1 break;
		proxy_pass http://package-cache:8081;
	}
}
server {
	listen 80;
	server_name security.ubuntu.com;
	location /ubuntu/ {
		rewrite ^/ubuntu/(.*)$ /repository/apt-ubuntu-security/$1 break;
		proxy_intercept_errors on;
		proxy_read_timeout 8s;
		error_page 502 503 504 = @ubuntu_security_mirror;
		proxy_pass http://package-cache:8081;
	}
	location @ubuntu_security_mirror {
		rewrite ^/repository/apt-ubuntu-security/(.*)$ /repository/apt-ubuntu-security-mirror/$1 break;
		proxy_pass http://package-cache:8081;
	}
}

server {
	listen 80;
	server_name dl-cdn.alpinelinux.org;
	location /alpine/ {
		rewrite ^/alpine/(.*)$ /repository/raw-alpine/$1 break;
		proxy_pass http://package-cache:8081;
	}
}

server {
	listen 443 ssl;
	server_name pypi.org;
	ssl_certificate     /etc/nginx/certs/pypi.org.crt;
	ssl_certificate_key /etc/nginx/certs/pypi.org.key;
	location / {
		proxy_pass http://package-cache:8081/repository/pypi-proxy/;
	}
}

server {
	listen 443 ssl;
	server_name files.pythonhosted.org;
	ssl_certificate     /etc/nginx/certs/files.pythonhosted.org.crt;
	ssl_certificate_key /etc/nginx/certs/files.pythonhosted.org.key;
	location / {
		proxy_pass http://package-cache:8081/repository/pypi-proxy/;
	}
}

server {
	listen 443 ssl;
	server_name registry.npmjs.org;
	ssl_certificate     /etc/nginx/certs/registry.npmjs.org.crt;
	ssl_certificate_key /etc/nginx/certs/registry.npmjs.org.key;
	# Tarball URLs Nexus emits already carry /repository/npm-proxy/; pass them
	# through as-is (no path on proxy_pass) so they aren't double-prefixed → 404.
	location /repository/npm-proxy/ {
		proxy_pass http://package-cache:8081;
	}
	location / {
		proxy_pass http://package-cache:8081/repository/npm-proxy/;
	}
}

server {
	listen 443 ssl;
	server_name rubygems.org;
	ssl_certificate     /etc/nginx/certs/rubygems.org.crt;
	ssl_certificate_key /etc/nginx/certs/rubygems.org.key;
	location / {
		proxy_pass http://package-cache:8081/repository/gem-proxy/;
	}
}
server {
	listen 443 ssl;
	server_name index.rubygems.org;
	ssl_certificate     /etc/nginx/certs/index.rubygems.org.crt;
	ssl_certificate_key /etc/nginx/certs/index.rubygems.org.key;
	location / {
		proxy_pass http://package-cache:8081/repository/gem-proxy/;
	}
}

server {
	listen 443 ssl;
	server_name repo.packagist.org;
	ssl_certificate     /etc/nginx/certs/repo.packagist.org.crt;
	ssl_certificate_key /etc/nginx/certs/repo.packagist.org.key;
	location / {
		proxy_pass http://package-cache:8081/repository/raw-packagist/;
	}
}

server {
	listen 443 ssl;
	server_name proxy.golang.org;
	ssl_certificate     /etc/nginx/certs/proxy.golang.org.crt;
	ssl_certificate_key /etc/nginx/certs/proxy.golang.org.key;
	location / {
		proxy_pass http://package-cache:8081/repository/go-proxy/;
	}
}

server {
	listen 443 ssl;
	server_name dl-cdn.alpinelinux.org;
	ssl_certificate     /etc/nginx/certs/dl-cdn.alpinelinux.org.crt;
	ssl_certificate_key /etc/nginx/certs/dl-cdn.alpinelinux.org.key;
	location / {
		proxy_pass http://package-cache:8081/repository/raw-alpine/;
	}
}

server {
	listen 443 ssl;
	server_name raw.githubusercontent.com;
	ssl_certificate     /etc/nginx/certs/raw.githubusercontent.com.crt;
	ssl_certificate_key /etc/nginx/certs/raw.githubusercontent.com.key;
	location / {
		proxy_pass http://package-cache:8081/repository/raw-githubusercontent/;
	}
}

server {
	listen 443 ssl;
	server_name codeload.github.com;
	ssl_certificate     /etc/nginx/certs/codeload.github.com.crt;
	ssl_certificate_key /etc/nginx/certs/codeload.github.com.key;
	location / {
		proxy_pass http://package-cache:8081/repository/raw-codeload-github/;
	}
}