daemon off;
user nginx;
worker_processes 1;

error_log /dev/stdout warn;
pid /var/run/nginx.pid;

events {
  worker_connections 1024;
}

http {
  types {
      text/html                                        html htm shtml;
      text/css                                         css;
      text/xml                                         xml;
      image/gif                                        gif;
      image/jpeg                                       jpeg jpg;
      application/javascript                           js;
      application/atom+xml                             atom;
      application/rss+xml                              rss;

      text/mathml                                      mml;
      text/plain                                       txt;
      text/vnd.sun.j2me.app-descriptor                 jad;
      text/vnd.wap.wml                                 wml;
      text/x-component                                 htc;

      image/png                                        png;
      image/svg+xml                                    svg svgz;
      image/tiff                                       tif tiff;
      image/vnd.wap.wbmp                               wbmp;
      image/webp                                       webp;
      image/x-icon                                     ico;
      image/x-jng                                      jng;
      image/x-ms-bmp                                   bmp;

      font/woff                                        woff;
      font/woff2                                       woff2;

      application/java-archive                         jar war ear;
      application/json                                 json;
      application/mac-binhex40                         hqx;
      application/msword                               doc;
      application/pdf                                  pdf;
      application/postscript                           ps eps ai;
      application/rtf                                  rtf;
      application/vnd.apple.mpegurl                    m3u8;
      application/vnd.google-earth.kml+xml             kml;
      application/vnd.google-earth.kmz                 kmz;
      application/vnd.ms-excel                         xls;
      application/vnd.ms-fontobject                    eot;
      application/vnd.ms-powerpoint                    ppt;
      application/vnd.oasis.opendocument.graphics      odg;
      application/vnd.oasis.opendocument.presentation  odp;
      application/vnd.oasis.opendocument.spreadsheet   ods;
      application/vnd.oasis.opendocument.text          odt;
      application/vnd.openxmlformats-officedocument.presentationml.presentation
                                                       pptx;
      application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
                                                       xlsx;
      application/vnd.openxmlformats-officedocument.wordprocessingml.document
                                                       docx;
      application/vnd.wap.wmlc                         wmlc;
      application/x-7z-compressed                      7z;
      application/x-cocoa                              cco;
      application/x-java-archive-diff                  jardiff;
      application/x-java-jnlp-file                     jnlp;
      application/x-makeself                           run;
      application/x-perl                               pl pm;
      application/x-pilot                              prc pdb;
      application/x-rar-compressed                     rar;
      application/x-redhat-package-manager             rpm;
      application/x-sea                                sea;
      application/x-shockwave-flash                    swf;
      application/x-stuffit                            sit;
      application/x-tcl                                tcl tk;
      application/x-x509-ca-cert                       der pem crt;
      application/x-xpinstall                          xpi;
      application/xhtml+xml                            xhtml;
      application/xspf+xml                             xspf;
      application/zip                                  zip;

      application/octet-stream                         bin exe dll;
      application/octet-stream                         deb;
      application/octet-stream                         dmg;
      application/octet-stream                         iso img;
      application/octet-stream                         msi msp msm;

      audio/midi                                       mid midi kar;
      audio/mpeg                                       mp3;
      audio/ogg                                        ogg;
      audio/x-m4a                                      m4a;
      audio/x-realaudio                                ra;

      video/3gpp                                       3gpp 3gp;
      video/mp2t                                       ts;
      video/mp4                                        mp4;
      video/mpeg                                       mpeg mpg;
      video/quicktime                                  mov;
      video/webm                                       webm;
      video/x-flv                                      flv;
      video/x-m4v                                      m4v;
      video/x-mng                                      mng;
      video/x-ms-asf                                   asx asf;
      video/x-ms-wmv                                   wmv;
      video/x-msvideo                                  avi;
  }

  default_type application/octet-stream;

  log_format combined_host '$host $remote_addr - $remote_user [$time_local] '
                           '"$request" $status $body_bytes_sent '
                           '"$http_referer" "$http_user_agent"';

  access_log /logs/default_server.log combined_host;

  sendfile on;
  tcp_nopush on;
  server_tokens off;

  keepalive_timeout 128;

  # Try to avoid buffering requests to disk
  client_body_buffer_size 1024k;

  gzip on;
  gzip_proxied any;
  gzip_disable "msie6";
  gzip_types application/javascript application/rss+xml application/x-javascript application/xhtml+xml application/xml image/svg+xml image/x-icon text/css text/javascript text/plain text/xml;

  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout 10m;
  ssl_dhparam /srv/nginx-conf/ssl/dhparam.pem;

  map $http_host $can_redirect {
      hostnames;

      default                            0;
      crute.me                           1;
      *.crute.me                         1;
      crute.us                           1;
      *.crute.us                         1;
  }

  server {
      listen *:80 default_server;
      listen [::]:80 default_server;

      access_log /logs/default_http_vhost.log combined_host;

      location / {
          if ($can_redirect) {
              rewrite (.*) https://$http_host$1 permanent;
          }

          default_type text/plain;
          return 404 "not found";
      }
  }

  # TODO: Consolidate these into one, they differ only by hostname and SSL cert
  # This is like this because I'm not sure if redirects will work at all with
  # git pulls and pretty much all repositories use code.crute.me not .us

  geo $cgit_config {
      default "/srv/code/etc/cgit-public.cfg";

      23.149.16.0/24 "/srv/code/etc/cgit-private.cfg";
      172.16.0.0/16 "/srv/code/etc/cgit-private.cfg";
      172.18.0.0/16 "/srv/code/etc/cgit-private.cfg";
      172.19.0.0/16 "/srv/code/etc/cgit-private.cfg";
      172.20.0.0/16 "/srv/code/etc/cgit-private.cfg";
      172.21.0.0/16 "/srv/code/etc/cgit-private.cfg";
      2602:803:4070::/64 "/srv/code/etc/cgit-private.cfg";
      2602:803:4072::/48 "/srv/code/etc/cgit-private.cfg";
      2602:803:4073::/48 "/srv/code/etc/cgit-private.cfg";
      2602:803:4074::/48 "/srv/code/etc/cgit-private.cfg";
      2602:803:4075::/48 "/srv/code/etc/cgit-private.cfg";
      2602:803:4076::/48 "/srv/code/etc/cgit-private.cfg";
  }

  server {
    listen *:443 ssl http2;
    listen [::]:443 ssl http2;

    server_name code.crute.me;
    access_log /logs/code.crute.me.log combined_host;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:AES256+EECDH:AES256+EDH:!DHE-RSA-AES256-SHA256:!DHE-RSA-AES256-SHA:!aNULL";
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.4.4 8.8.8.8 valid=300s;
    resolver_timeout 5s;

    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Xss-Protection "1; mode=block" always;
    add_header Referrer-Policy "same-origin" always;

    ssl_certificate /srv/nginx-conf/ssl/letsencrypt_crute_me.pem;
    ssl_certificate_key /srv/nginx-conf/ssl/letsencrypt_crute_me_key.pem;

    add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src https://wiki.crute.me/ 'self';" always;

    client_max_body_size 4G;

    # This is somewhat ugly and naive because it doesn't allow more than host/user/repo and some
    # repos exist at deeper paths than that. This should be fixed and moved out of nginx at some
    # point it's just quick and easy to put it here.
    location ~ ^/(?<user>[^/]*)/(?<repo>[^/]+)/?(?<subpath>.*)?$ {
      if ($arg_go-get = "1") {
        add_header Content-Type text/plain;
        return 200 '<html><head>
    <meta name="go-import" content="$host/$user/$repo git https://$host/$user/$repo">
    <meta name="go-source" content="$host/$user/$repo
          https://$host/$user/$repo
          https://$host/$user/$repo/tree{/dir}
          https://$host/$user/$repo/tree{/dir}/{file}#n{line}">
  </head></html>';
      }

      uwsgi_param  QUERY_STRING       $query_string;
      uwsgi_param  REQUEST_METHOD     $request_method;
      uwsgi_param  CONTENT_TYPE       $content_type;
      uwsgi_param  CONTENT_LENGTH     $content_length;

      uwsgi_param  REQUEST_URI        $request_uri;
      uwsgi_param  PATH_INFO          $document_uri;
      uwsgi_param  DOCUMENT_ROOT      $document_root;
      uwsgi_param  SERVER_PROTOCOL    $server_protocol;
      uwsgi_param  REQUEST_SCHEME     $scheme;
      uwsgi_param  HTTPS              $https if_not_empty;

      uwsgi_param  REMOTE_ADDR        $remote_addr;
      uwsgi_param  REMOTE_PORT        $remote_port;
      uwsgi_param  SERVER_PORT        $server_port;
      uwsgi_param  SERVER_NAME        $server_name;

      uwsgi_param  HTTP_HOST          $host;
      uwsgi_param  HTTP_X_FORWARDED_FOR    $proxy_add_x_forwarded_for;

      uwsgi_modifier1 9;
      uwsgi_param CGIT_CONFIG $cgit_config;
      uwsgi_pass uwsgi://127.0.0.1:9000;
    }

    location / {
      uwsgi_param  QUERY_STRING       $query_string;
      uwsgi_param  REQUEST_METHOD     $request_method;
      uwsgi_param  CONTENT_TYPE       $content_type;
      uwsgi_param  CONTENT_LENGTH     $content_length;

      uwsgi_param  REQUEST_URI        $request_uri;
      uwsgi_param  PATH_INFO          $document_uri;
      uwsgi_param  DOCUMENT_ROOT      $document_root;
      uwsgi_param  SERVER_PROTOCOL    $server_protocol;
      uwsgi_param  REQUEST_SCHEME     $scheme;
      uwsgi_param  HTTPS              $https if_not_empty;

      uwsgi_param  REMOTE_ADDR        $remote_addr;
      uwsgi_param  REMOTE_PORT        $remote_port;
      uwsgi_param  SERVER_PORT        $server_port;
      uwsgi_param  SERVER_NAME        $server_name;

      uwsgi_param  HTTP_HOST          $host;
      uwsgi_param  HTTP_X_FORWARDED_FOR    $proxy_add_x_forwarded_for;

      uwsgi_modifier1 9;
      uwsgi_param CGIT_CONFIG $cgit_config;
      uwsgi_pass uwsgi://127.0.0.1:9000;
    }
  }

  server {
    listen *:443 ssl http2;
    listen [::]:443 ssl http2;

    server_name code.crute.us;
    access_log /logs/code.crute.me.log combined_host;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:AES256+EECDH:AES256+EDH:!DHE-RSA-AES256-SHA256:!DHE-RSA-AES256-SHA:!aNULL";
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.4.4 8.8.8.8 valid=300s;
    resolver_timeout 5s;

    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Xss-Protection "1; mode=block" always;
    add_header Referrer-Policy "same-origin" always;

    ssl_certificate /srv/nginx-conf/ssl/letsencrypt_crute_us.pem;
    ssl_certificate_key /srv/nginx-conf/ssl/letsencrypt_crute_us_key.pem;

    add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src https://wiki.crute.me/ 'self';" always;

    client_max_body_size 4G;

    # This is somewhat ugly and naive because it doesn't allow more than host/user/repo and some
    # repos exist at deeper paths than that. This should be fixed and moved out of nginx at some
    # point it's just quick and easy to put it here.
    location ~ ^/(?<user>[^/]*)/(?<repo>[^/]+)/?(?<subpath>.*)?$ {
      if ($arg_go-get = "1") {
        add_header Content-Type text/plain;
        return 200 '<html><head>
    <meta name="go-import" content="$host/$user/$repo git https://$host/$user/$repo">
    <meta name="go-source" content="$host/$user/$repo
          https://$host/$user/$repo
          https://$host/$user/$repo/tree{/dir}
          https://$host/$user/$repo/tree{/dir}/{file}#n{line}">
  </head></html>';
      }

      uwsgi_param  QUERY_STRING       $query_string;
      uwsgi_param  REQUEST_METHOD     $request_method;
      uwsgi_param  CONTENT_TYPE       $content_type;
      uwsgi_param  CONTENT_LENGTH     $content_length;

      uwsgi_param  REQUEST_URI        $request_uri;
      uwsgi_param  PATH_INFO          $document_uri;
      uwsgi_param  DOCUMENT_ROOT      $document_root;
      uwsgi_param  SERVER_PROTOCOL    $server_protocol;
      uwsgi_param  REQUEST_SCHEME     $scheme;
      uwsgi_param  HTTPS              $https if_not_empty;

      uwsgi_param  REMOTE_ADDR        $remote_addr;
      uwsgi_param  REMOTE_PORT        $remote_port;
      uwsgi_param  SERVER_PORT        $server_port;
      uwsgi_param  SERVER_NAME        $server_name;

      uwsgi_param  HTTP_HOST          $host;
      uwsgi_param  HTTP_X_FORWARDED_FOR    $proxy_add_x_forwarded_for;

      uwsgi_modifier1 9;
      uwsgi_param CGIT_CONFIG $cgit_config;
      uwsgi_pass uwsgi://127.0.0.1:9000;
    }

    location / {
      uwsgi_param  QUERY_STRING       $query_string;
      uwsgi_param  REQUEST_METHOD     $request_method;
      uwsgi_param  CONTENT_TYPE       $content_type;
      uwsgi_param  CONTENT_LENGTH     $content_length;

      uwsgi_param  REQUEST_URI        $request_uri;
      uwsgi_param  PATH_INFO          $document_uri;
      uwsgi_param  DOCUMENT_ROOT      $document_root;
      uwsgi_param  SERVER_PROTOCOL    $server_protocol;
      uwsgi_param  REQUEST_SCHEME     $scheme;
      uwsgi_param  HTTPS              $https if_not_empty;

      uwsgi_param  REMOTE_ADDR        $remote_addr;
      uwsgi_param  REMOTE_PORT        $remote_port;
      uwsgi_param  SERVER_PORT        $server_port;
      uwsgi_param  SERVER_NAME        $server_name;

      uwsgi_param  HTTP_HOST          $host;
      uwsgi_param  HTTP_X_FORWARDED_FOR    $proxy_add_x_forwarded_for;

      uwsgi_modifier1 9;
      uwsgi_param CGIT_CONFIG $cgit_config;
      uwsgi_pass uwsgi://127.0.0.1:9000;
    }
  }
}