resolver 127.0.0.11 valid=10s;

upstream ffsecurity {
        zone ffmulti 64k;
        keepalive 128;
        server findface-multi-legacy:8002 resolve;
}

upstream ffsecurity-ws {
        zone ffmulti 64k;
        server findface-multi-legacy:8003 resolve;
}

upstream ffsecurity-django {
        zone ffmulti 64k;
        server findface-multi-legacy:8004 resolve;
}

upstream audit {
        zone ffmulti 64k;
        server findface-multi-audit:8002 resolve;
}

upstream identity-provider {
        zone ffmulti 64k;
        server findface-multi-identity-provider:8002 resolve;
}

upstream alerts {
        zone ffmulti 64k;
        server findface-multi-alerts:8013 resolve;
}

upstream annex-ws {
        zone ffmulti 64k;
        server service_notifier_ws:3311 resolve;
}

upstream annex-http {
        zone ffmulti 64k;
        server backend_api:2222 resolve;
}

upstream annex-upload {
        zone ffmulti 64k;
        server findface-upload:3333 resolve;
}

upstream replication-receiver {
        zone ffmulti 64k;
        server findface-multi-replication-receiver:8014 resolve;
}

upstream replication-sender {
        zone ffmulti 64k;
        server findface-multi-replication-sender:8015 resolve;
}

map $http_upgrade $ffsec_upstream {
        default "http://ffsecurity-ws";
        "" "http://ffsecurity";
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        keepalive_timeout 30;
        keepalive_requests 1000;

        ssl_certificate /etc/ssl/domain.crt;
        ssl_certificate_key /etc/ssl/domain.key;

        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;

        http2 on;

        root /var/lib/findface-security;

        autoindex off;

        server_name _;
        server_tokens off;

        # fix for https://github.com/docker/compose/issues/3412
        resolver 127.0.0.11;

        set $csp_policy "default-src 'self'; img-src 'self' *.tile.openstreetmap.org blob: data:; media-src 'self' blob:; connect-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self';  object-src 'self'; frame-ancestors 'self'";
        # to secure set the value from "*" to "https://www.youapp.com"
        set $cors_origin "*"; 
        set $static_files_cache_header "public, max-age=86400"; 
        # set "no-store" if you want to disable caching

        add_header Content-Security-Policy $csp_policy;        
        add_header Cache-Control "no-store";
        add_header Pragma "no-cache";

        add_header X-XSS-Protection "1; mode=block";
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options nosniff always;
        add_header X-Permitted-Cross-Domain-Policies none always;
        add_header Referrer-Policy same-origin always;

        location = / {
                alias /usr/share/findface-security-ui/;
                try_files /index.html =404;
        }

        location /uploads/ {
                # internal; # uncomment if you intend to enable OVERPROTECT_MEDIA
                add_header 'Access-Control-Allow-Origin' $cors_origin always;
                add_header 'Access-Control-Allow-Methods' '*' always;
                add_header 'Access-Control-Allow-Headers' '*' always;
                add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range'  always;
                add_header 'Access-Control-Max-Age' 2592000 always;
                add_header 'Cache-Control' $static_files_cache_header;
                
                location /uploads/event/ {
                        root /;
                        try_files /var/lib/fast-storage$uri /var/lib/findface-security$uri =404;
                }

                location /uploads/annex/ {
                        proxy_pass http://annex-upload/uploads/annex/;
                }

                location ~ /card/(?<card_type>[a-zA-Z]+)/(?<card_id>[0-9]+)/attachments/(.*)$ {
                        add_header 'Content-Disposition' 'attachment';
                        add_header 'Content-Security-Policy' 'sandbox';
                }
        }
        location /uploads/videos/ {
                # add_header 'Access-Control-Allow-Origin' '*';
                # add_header 'Access-Control-Allow-Methods' '*';
                # add_header 'Access-Control-Allow-Headers' '*';
                # add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
                # add_header 'Access-Control-Max-Age' 2592000;
        }
        location /ui-static/ {
                alias /usr/share/findface-security-ui/ui-static/;
        }
        location /doc/ {
                alias /opt/findface-security/doc/;
                # Disable this add-header to enable advanced security policy
                add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob: data:; media-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; frame-src 'self';  object-src 'self';";
        }
        location /api-docs/ {
                alias /opt/findface-security/rapidoc/;
                # add_header Content-Security-Policy "default-src 'self'; img-src 'self' blob: data:; media-src 'self' blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-src 'self';  object-src 'self';";
                # try_files $uri index.html =404;
        }
        location ~ /videos/(?<video_id>[0-9]+)/upload/(.*)$ {
                client_max_body_size 15g;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_pass http://ffsecurity;
        }

        location @django {
                internal;
                client_max_body_size 1g;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_http_version 1.1;
                proxy_read_timeout 5m;
                proxy_pass http://ffsecurity-django;
        }

#      location /v1/video-liveness {
#          add_header Access-Control-Allow-Headers "*" always;
#          add_header Access-Control-Allow-Methods "*" always;
#          add_header Access-Control-Allow-Origin  "*" always;
#
#          if ($request_method = 'OPTIONS') {
#              return 204;
#          }
#
#          client_max_body_size 300m;
#          proxy_set_header Host $http_host;
#          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
#          proxy_set_header X-Forwarded-Proto $scheme;
#          proxy_pass http://127.0.0.1:18301;
#          proxy_read_timeout 5m;
#      }

        location / {
                client_max_body_size 1g;
                proxy_set_header Host $http_host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_pass $ffsec_upstream;
                proxy_read_timeout 5m;

                proxy_hide_header 'Access-Control-Allow-Origin';
                add_header 'Access-Control-Allow-Origin' $cors_origin always;


                location ~ ^/(cameras|videos|vms|external-vms).*/stream/?$ {
                        proxy_set_header Host $http_host;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                        proxy_pass http://ffsecurity;
                }

                location ~ ^/streams/(.*)$ {
                        internal;
                        proxy_pass $1$is_args$args;
                }

                location /audit-logs {
#                         temporary redirect requests to service `legacy`
#                         change back to `http://audit` when audit service will be enabled
#                         proxy_pass http://audit;
                        proxy_pass http://ffsecurity;
                }

                location /annex/ {
                        proxy_pass http://annex-ws/;
                }
                location /v1/alert-rules {
                        proxy_pass http://alerts;
                }
                location /service_alarmer {
                        proxy_pass http://annex-http;
                }
                location /api/v1/originating-system {
                        proxy_pass http://replication-receiver;
                }
                location /api/v1/processing-system {
                        proxy_pass http://replication-sender;
                }

                # uncomment to setup custom command execution
                # location /custom/ {
                #         proxy_pass http://custom/;
                # }

                location ~ ^/(auth|ad_groups|cproauth|groups|permissions|sessions|users|user-face|device-blacklist-records) {
                        proxy_pass http://identity-provider;
                }
        }



#       location /users/me/ad {
#
#                 proxy_pass <FFmulti_address>/auth/ad_login/; e.g http://127.0.0.1/auth/ad_login/;
#                 proxy_method POST;
#
#                 proxy_set_header   X-Real-IP $remote_addr;
#                 proxy_set_header   Host $http_host;
#                 proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
#                 proxy_set_header  Authorization $http_authorization;
#                 proxy_pass_header Authorization;
#                 proxy_no_cache 1;
#                 proxy_cache_bypass 1;
#
#                 auth_gss on;
#                 auth_gss_realm <REALM>; # e.g. TESTNTL.LOCAL;
#                 auth_gss_keytab <path/to/file.keytab>; # e.g. /var/lib/web.keytab
#                 auth_gss_service_name <service_name>; # e.g. HTTP/web.testntl.local;
#                 auth_gss_allow_basic_fallback on;
#         }

}
