# Internal configuration file for nextcloud
# Verify time by time, that this rules are valid:
# https://docs.nextcloud.com/server/latest/admin_manual/installation/nginx.html
worker_processes {{ WEBSERVER_WORKER_PROCESSES }};
error_log   /proc/self/fd/2 {% if MODE_DEBUG | bool %}debug{% else %}warn{% endif %};
pid        /var/run/nginx.pid;
events {
    worker_connections {{ WEBSERVER_WORKER_CONNECTIONS }};
}
http {
    {{ NETWORK_DOCKER_DNS_NGINX_DIRECTIVE }}
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;
    types {
        application/javascript   mjs;
        application/wasm         wasm;
        application/octet-stream tflite;
    }
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
    access_log /proc/self/fd/1 main;
    sendfile        on;
    keepalive_timeout     65;
    fastcgi_send_timeout  900s;
    fastcgi_read_timeout  900s;
    proxy_buffering       off;
    server {
        listen 80;
        {% if lookup('tls', application_id, 'enabled') | bool %}
        add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always;
        {% endif %}
        client_max_body_size 512M;
        fastcgi_buffers 64 4K;
        gzip on;
        gzip_vary on;
        gzip_comp_level 4;
        gzip_min_length 256;
        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
        add_header Referrer-Policy                      "no-referrer"           always;
        add_header X-Content-Type-Options               "nosniff"               always;
        add_header X-Robots-Tag                         "noindex, nofollow"     always;
        fastcgi_hide_header X-Powered-By;
        root {{ NEXTCLOUD_DOCKER_WORK_DIRECTORY }};
        index index.php index.html /index.php$request_uri;
        location = / {
            if ( $http_user_agent ~ ^DavClnt ) {
                return 302 /remote.php/webdav/$is_args$args;
            }
        }
        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }
        location = /healthz/ready {
            access_log off;
            default_type text/plain;
            return 200 "ready\n";
        }
        location ^~ /.well-known {
            location = /.well-known/carddav { return 301 /remote.php/dav/; }
            location = /.well-known/caldav  { return 301 /remote.php/dav/; }
            location = /.well-known/webfinger { return 301 /index.php/.well-known/webfinger; }
            location = /.well-known/nodeinfo  { return 301 /index.php/.well-known/nodeinfo; }
            location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
            location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
            return 301 /index.php$request_uri;
        }
        location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
        location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }
        location ~ \.php(?:$|/) {
            rewrite ^/(?!index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|ocs-provider\/.+|.+\/richdocumentscode(_arm64)?\/proxy) /index.php$request_uri;
            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
            set $path_info $fastcgi_path_info;
            try_files $fastcgi_script_name =404;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_param modHeadersAvailable true;         # Avoid sending the security headers twice
            fastcgi_param front_controller_active true;     # Enable pretty urls
            set $php_handler {{ NEXTCLOUD_SERVICE }}:{{ NEXTCLOUD_FPM_PORT }};
            fastcgi_pass $php_handler;
            fastcgi_intercept_errors on;
            fastcgi_request_buffering off;
        }
        location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac)$ {
            try_files $uri /index.php$request_uri;
            expires 6M;         # Cache-Control policy borrowed from `.htaccess`
            access_log off;     # Optional: Don't log access to assets
        }
        location ~ \.(otf|woff2?)$ {
            try_files $uri /index.php$request_uri;
            expires 7d;         # Cache-Control policy borrowed from `.htaccess`
            access_log off;     # Optional: Don't log access to assets
        }
        location /remote {
            return 301 /remote.php$request_uri;
        }
        location / {
            try_files $uri $uri/ /index.php$request_uri;
        }
        location {{ NEXTCLOUD_WHITEBOARD_LOCATION }} {
            set $upstream_nextcloud_whiteboard http://whiteboard:{{ NEXTCLOUD_WHITEBOARD_PORT_INTERNAL }};
            rewrite ^{{ NEXTCLOUD_WHITEBOARD_LOCATION }}(.*)$ /$1 break;
            proxy_pass         $upstream_nextcloud_whiteboard;
            proxy_http_version 1.1;
            proxy_set_header   Host              $host;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   Upgrade           $http_upgrade;
            proxy_set_header   Connection        "upgrade";
            proxy_read_timeout 3600;
        }
{% if NEXTCLOUD_HPB_SIGNALING_ENABLED | bool %}
        location {{ NEXTCLOUD_HPB_SIGNALING_LOCATION }} {
{% if NEXTCLOUD_HPB_NETWORK_MODE == 'host' %}
            proxy_pass          http://host.docker.internal:{{ NEXTCLOUD_HPB_SIGNALING_PORT }}/;
{% else %}
            set $upstream_nextcloud_talk http://talk:{{ NEXTCLOUD_HPB_SIGNALING_PORT }};
            rewrite ^{{ NEXTCLOUD_HPB_SIGNALING_LOCATION }}(.*)$ /$1 break;
            proxy_pass          $upstream_nextcloud_talk;
{% endif %}
            proxy_http_version  1.1;
            proxy_set_header    Host              $host;
            proxy_set_header    Upgrade           $http_upgrade;
            proxy_set_header    Connection        "upgrade";
            proxy_read_timeout  3600;
            proxy_buffering     off;
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
        }
{% endif %}
    }
}