apiVersion: v1
kind: ConfigMap
metadata:
  name: karrot-nginx-template
  namespace: {{ .namespace }}
data:
  default.conf.template: |
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    client_max_body_size ${FILE_UPLOAD_MAX_SIZE};

    server {

        listen ${LISTEN};

        set_real_ip_from 10.0.0.0/8;
        set_real_ip_from 172.16.0.0/12;
        set_real_ip_from 192.168.0.0/16;
        real_ip_header X-Forwarded-For;

        root /usr/share/nginx/html;

        location /assets {
          expires max;
        }

        location /css {
          expires max;
        }

        location /js {
          expires max;
        }

        location /img {
          expires max;
        }

        location /fonts {
          expires max;
        }

        location / {

            try_files $uri /index.html;

            add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
            add_header X-Content-Type-Options nosniff;

            add_header Last-Modified $date_gmt;
            add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';

            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; connect-src 'self' https://nominatim.openstreetmap.org https://sentry.io https://*.ingest.sentry.io ${CSP_CONNECT_SRC} blob:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' https: data: blob:;";

            if_modified_since off;
            expires off;
            etag off;
        }

        location /bundlesize.html {
            add_header Content-Security-Policy "default-src 'self' 'unsafe-inline';";
            add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
        }

        location ~ ^\/(api(\-auth)?|docs|silk|static)\/ {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header Host $http_host;

            proxy_pass http://${BACKEND};

            proxy_redirect off;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Sec-WebSocket-Extensions $http_sec_websocket_extensions;
            proxy_set_header Sec-WebSocket-Key $http_sec_websocket_key;
            proxy_set_header Sec-WebSocket-Protocol $http_sec_websocket_protocol;
            proxy_set_header Sec-WebSocket-Version $http_sec_websocket_version;
        }

        location /media/ {
            alias ${FILE_UPLOAD_DIR};
            expires max;
        }

        location /media/tmp/ {
            deny all;
            return 404;
        }

        location ~ /media/conversation_message_attachment_(files|previews|thumbnails)/ {
            deny all;
            return 404;
        }

        location /uploads/ {
            internal;
            alias ${FILE_UPLOAD_DIR};
            etag on;
        }

        location /community_proxy/ {
            proxy_pass https://community.karrot.world/;
        }

        error_page 503 @maintenance;

        location @maintenance {
          try_files /maintenance.html =503;
        }

    }