---
# Webserver Configuration

# Effective CPUs (float) across proxy and the current app
WEBSERVER_CPUS_EFFECTIVE: >-
  {{
    [
      (lookup('applications') | resource_filter('svc-prx-openresty',  'cpus', service_name | default(''), RESOURCE_CPUS)) | float,
      (lookup('applications') | resource_filter(application_id,       'cpus', service_name | default(''), RESOURCE_CPUS)) | float
    ] | min
  }}

WEBSERVER_WORKER_PROCESSES: >-
  {{
    1 if (WEBSERVER_CPUS_EFFECTIVE | float) < 1
    else (WEBSERVER_CPUS_EFFECTIVE | float | int)
  }}

# worker_connections from pids_limit (use the smaller one), with correct key/defaults
WEBSERVER_WORKER_CONNECTIONS: >-
  {{
    [
      (lookup('applications') | resource_filter('svc-prx-openresty', 'pids_limit', service_name | default(''), RESOURCE_PIDS_LIMIT)) | int,
      (lookup('applications') | resource_filter(application_id,      'pids_limit', service_name | default(''), RESOURCE_PIDS_LIMIT)) | int
    ] | min
  }}

# Not WEBSERVER_WORKER_*: their application_id is whichever role loaded the shared proxy first, whose limits then cap every vhost.
WEBSERVER_PROXY_WORKER_PROCESSES: >-
  {{
    [
      (lookup('applications') | resource_filter('svc-prx-openresty', 'cpus', '', RESOURCE_CPUS)) | float | int,
      1
    ] | max
  }}

WEBSERVER_PROXY_WORKER_CONNECTIONS: "{{ lookup('config', 'svc-prx-openresty', 'services.openresty.worker_connections') | int }}"

WEBSERVER_PROXY_WORKER_RLIMIT_NOFILE: "{{ (WEBSERVER_PROXY_WORKER_CONNECTIONS | int) * 2 }}"

# Response security headers of every vhost; an app overrides any key under `security_headers` in its meta/server.yml.
WEBSERVER_SECURITY_HEADERS:
  nosniff: false # X-Content-Type-Options: nosniff
  referrer_policy: "" # Referrer-Policy, sent only when the upstream sends none; "" sends none
  permissions_policy: "" # Permissions-Policy on HTML documents; "" sends none
  hsts:
    max_age: 31536000 # Strict-Transport-Security max-age in seconds
    include_subdomains: false # adds includeSubDomains, which covers every subdomain of the vhost
    preload: false # adds preload; requires include_subdomains and a max_age of one year