#https://github.com/LemmyNet/lemmy-ansible/blob/main/templates/nginx_internal.conf

#limit_req_zone $binary_remote_addr zone=lemmy_ratelimit:10m rate=1r/s;

# Only connect to this site via HTTPS for the two years
more_set_headers "Strict-Transport-Security: max-age=63072000";

# Various content security headers
more_set_headers "Referrer-Policy: same-origin";
more_set_headers "X-Content-Type-Options: nosniff";
more_set_headers "X-Frame-Options: DENY";
more_set_headers "X-XSS-Protection: 1; mode=block";

# Upload limit for pictrs
client_max_body_size 20M;

# frontend
location / {
  # The default ports:
  # lemmy_ui_port: 1235
  # lemmy_port: 8536

  set $proxpass "http://127.0.0.1:__PORT_UI__";

  if ($http_accept ~ "^application/.*$") {
    set $proxpass "http://127.0.0.1:__PORT__";
  }
  if ($request_method = POST) {
    set $proxpass "http://127.0.0.1:__PORT__";
  }
  proxy_pass $proxpass;

  rewrite ^(.+)/+$ $1 permanent;
  # Send actual client IP upstream
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

# backend
location ~ ^/(api|pictrs|feeds|nodeinfo|.well-known) {
  proxy_pass http://127.0.0.1:__PORT__;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";

  # Send actual client IP upstream
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header Host $host;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

# Redirect pictshare images to pictrs
location ~ /pictshare/(.*)$ {
  return 301 /pictrs/image/$1;
}

# Anonymize IP addresses
# https://www.supertechcrew.com/anonymizing-logs-nginx-apache/
#map $remote_addr $remote_addr_anon {
#  ~(?P<ip>\d+\.\d+\.\d+)\.    $ip.0;
#  ~(?P<ip>[^:]+:[^:]+):       $ip::;
#  127.0.0.1                   $remote_addr;
#  ::1                         $remote_addr;
#  default                     0.0.0.0;
#}
#log_format main '$remote_addr_anon - $remote_user [$time_local] "$request" '
#'$status $body_bytes_sent "$http_referer" "$http_user_agent"';
#access_log /var/log/nginx/access.log main;