# HTTP server
server {
	listen 80;
	listen [::]:80;
	server_name rg.domain.tld; # add here, space separated, more names
	server_tokens off;
	root /usr/share/rocketgit/root;

	tcp_nopush on;
	sendfile on;

	# TODO - is ok in this context?
	client_max_body_size 1000m;
	# more than that is written into a file first
	client_body_buffer_size 128k;

	# timeouts
	client_body_timeout 10;
	client_header_timeout 10;
	keepalive_timeout 30;
	send_timeout 10;

	# Security (ClickJacking)
        add_header X-Frame-Options DENY;
	# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
	add_header X-Content-Type-Options nosniff;
	# XSS protection
	add_header X-XSS-Protection "1; mode=block";

	access_log /var/log/nginx/rg-access.log;
	error_log /var/log/nginx/rg-error.log;

	if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$) { return 444; }

	# Force the use of only one name even if we have more aliases.
	# Before un-commenting it, change SERVERNAME and PORT to real values
	#if ($host != SERVERNAME) {
	#	rewrite  ^/?(.*)$  http://SERVERNAME:PORT/$1  permanent;
	#}

	location ~ ^/(favicon\.ico|themes/.*|robots\.txt|\.well-known/.*)$ {
		expires 1d;
	}

	location / {
		gzip on;
		#gzip_comp_level 6;
		gzip_types text/plain text/xml text/css text/javascript application/javascript application/x-javascript;

		# To be able to know that the client closed the connection
		# TODO: equivalent for apache?
		fastcgi_ignore_client_abort off;

		# To allow streaming of the response data to client
		fastcgi_buffering off;

		# TODO
		fastcgi_keep_conn	on;

		include /etc/nginx/fastcgi_params;
		fastcgi_param SCRIPT_FILENAME	$document_root/index.php$fastcgi_script_name;

		fastcgi_pass unix:/run/rocketgit.sock;
	}
}

# HTTPS server
server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name rg.domain.tld; # add here, space separated, more names
	server_tokens off;
	root /usr/share/rocketgit/root;

	tcp_nopush on;
	sendfile on;

	# TODO - is ok in this context? You can put 0 for no limit.
	client_max_body_size 1000m;
	# more than that is written into a file first
	client_body_buffer_size 128k;

	# timeouts
	client_body_timeout 10;
	client_header_timeout 10;
	keepalive_timeout 30;
	send_timeout 10;

	# Security (ClickJacking)
        add_header X-Frame-Options DENY;
	# https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
	add_header X-Content-Type-Options nosniff;
	# XSS protection
	add_header X-XSS-Protection "1; mode=block";
	# Security (STS)
	add_header Strict-Transport-Security "max-age=31536000";

	access_log /var/log/nginx/rg-ssl-access.log;
	error_log /var/log/nginx/rg-ssl-error.log;

	if ($request_method !~ ^(GET|HEAD|POST|OPTIONS)$) { return 444; }

	# Force the use of only one name even if we have more aliases.
	# Before un-commenting it, change SERVERNAME and PORT to real values
	#if ($host != SERVERNAME) {
	#	rewrite  ^/?(.*)$  https://SERVERNAME[:PORT]/$1  permanent;
	#}

	location ~ ^/(favicon\.ico|themes/.*|robots\.txt|\.well-known/.*)$ {
		expires 1d;
		gzip on;
		gzip_comp_level 9;
		gzip_types text/plain text/xml text/css text/javascript application/javascript application/x-javascript application/json image/svg+xml;
	}

	location / {
		gzip on;
		gzip_comp_level 5;
		gzip_types text/plain text/xml application/json image/svg+xml;

		# To be able to know that the client closed the connection
		# TODO: equivalent for apache?
		fastcgi_ignore_client_abort on;

		# To allow streaming of the response data to client
		fastcgi_buffering off;

		# TODO
		fastcgi_keep_conn	on;

		include /etc/nginx/fastcgi_params;
		fastcgi_param SCRIPT_FILENAME	$document_root/index.php$fastcgi_script_name;

		fastcgi_pass unix:/run/rocketgit.sock;
	}

	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_certificate /etc/pki/tls/certs/localhost.crt;
	ssl_certificate_key /etc/pki/tls/private/localhost.key;
	# Specify the cyphers to get an A+ on Qualys (ssllabs.com); recommended
	# https://www.digicert.com/ssl-support/ssl-enabling-perfect-forward-secrecy.htm
	# Generated by: https://ssl-config.mozilla.org
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_session_cache shared:SSL:60m;
	ssl_session_timeout 1d;
	ssl_session_tickets off;

	#ssl_stapling on;
	#ssl_trusted_certificate /etc/letsencrypt/live/r1.embedromix.ro/chain.pem;
	#ssl_stapling_verify on;

	# https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning
	# To generate pin-sha256 string: openssl s_client -servername <server> -connect <server>:443 | openssl x509 -pubkey -noout | openssl rsa -pubin -outform der | openssl dgst -sha256 -binary | openssl enc -base64
	# add_header Public-Key-Pins "pin-sha256=\"base64+primary==\"; pin-sha256=\"base64+backup==\"; max-age=5184000; includeSubDomains; report-uri=\"https://www.example.org/hpkp-report\""
	# add_header Public-Key-Pins-Report-Only ... # to not block users!
}