events {}

http {
	include mime.types;

	upstream homepage {
		server homepage:8000;
	}

	upstream server {
		server server:8080;
	}

	map $request_uri $expires {
		default off;
		"~-[0-9a-z]{10}\.js$" 1d;
		"~*(woff|woff2|ttf|eot)$" 1d;
	}

	map $sent_http_content_type $csp {
		default "";
		"~^text/html" "default-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
	}

	server {
		listen 80;
		expires $expires;
		add_header Content-Security-Policy $csp;
		add_header Referrer-Policy 'origin-when-cross-origin';
		add_header X-Content-Type-Options 'nosniff';
		add_header X-XSS-Protection '1; mode=block';

		location /api/ {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /vault/ {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /auditorium/ {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /script.js {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /normalize.css {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /skeleton.css {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /healthz {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /versionz {
			proxy_pass http://server;
			proxy_redirect off;
		}

		location /favicon.ico {
			root /www/data/theme/images;
		}

		location / {
			proxy_pass http://homepage;
			proxy_redirect off;
		}

		error_page 404 /custom_404.html;
		# in development, this handles empty responses by the pelican dev server which are 404s in the end
		error_page 502 /custom_404.html;
		location = /custom_404.html {
			internal;
			proxy_pass http://homepage/404.html;
			proxy_redirect off;
			add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
		}
	}
}