server_names_hash_bucket_size 64;
proxy_headers_hash_bucket_size 512;
server_names_hash_max_size 512;
large_client_header_buffers 8 64k;
proxy_read_timeout 3600;
proxy_connect_timeout 3600;


# include configs for spamers, bad bots to reject
include /customization/blacklist.conf;


# Rate limit configurations
limit_req_zone $binary_remote_addr zone=all:10m rate=20r/s;

map $http_user_agent $limit_bots {
    default '';
    ~*(google|bing|yandex|msnbot|baidu|crawler|robot) $binary_remote_addr;
}
limit_req_zone $limit_bots zone=bots:10m rate=2r/m;

# Connect to the Arches Django app running with
# Gunicorn. Note, you need to match more than the port
# number, you need match the Docker container NAME where
# we've launched the Arches Djagno app.
upstream django {
  server arches:8000;
}

upstream mapas {
  server pg_tilesrv:7800;
}

server {
    listen 80;
    charset utf-8;
    server_name ${DEPLOY_HOST} www.${DEPLOY_HOST};

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        autoindex on;
        allow all;
        root /var/www/certbot/$host;
    }

    access_log /logs/nginx/access.log;
    error_log /logs/nginx/error.log;

    proxy_read_timeout 3600;

    proxy_set_header  X-Forwarded-Protocol  $scheme;
    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/ld+json
application/geo+json text/xml application/xml application/xml+rss
text/javascript application/javascript text/html;

    # block the evil spammers and bad bots
    if ($bad_bot) {
        return 444;
    }
    if ($bad_referer_block) {
        return 444;
    }
    if ($bad_urls1) {
        return 403;
    }
    if ($bad_urls2) {
        return 403;
    }
    if ($bad_urls3) {
        return 403;
    }
    if ($bad_urls4) {
        return 403;
    }
    if ($bad_urls5) {
        return 403;
    }
    if ($bad_urls6) {
        return 403;
    }

    location /.nginx {
        alias /var/www/html/${DEPLOY_HOST};
    }

    location / {
        return 301 https://$host$request_uri;
    }

}


server {
    listen       443 ssl;

    server_name ${DEPLOY_HOST} www.${DEPLOY_HOST};
    access_log /logs/nginx/ssl_access.log;
    error_log /logs/nginx/ssl_error.log;

    proxy_set_header  X-Forwarded-Protocol  $scheme;
    proxy_read_timeout 3600;

    ssl_certificate /etc/symb_link_ssl/fullchain.pem;
    ssl_certificate_key /etc/symb_link_ssl/privkey.pem;

    include /etc/nginx/options-ssl-nginx.conf;

    ssl_dhparam /etc/nginx/sites/ssl/ssl-dhparams.pem;

    include /etc/nginx/hsts.conf;

    # Allows upload of up to a 100MB file
    client_max_body_size 100M;

    gzip on;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/ld+json
application/geo+json text/xml application/xml application/xml+rss
text/javascript application/javascript text/html;

    # block the evil spammers and bad bots
    if ($bad_bot) {
        return 444;
    }
    if ($bad_referer_block) {
        return 444;
    }
    if ($bad_urls1) {
        return 403;
    }
    if ($bad_urls2) {
        return 403;
    }
    if ($bad_urls3) {
        return 403;
    }
    if ($bad_urls4) {
        return 403;
    }
    if ($bad_urls5) {
        return 403;
    }
    if ($bad_urls6) {
        return 403;
    }

    location /.nginx {
        autoindex on;
        alias /var/www/html/${DEPLOY_HOST};
    }

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        autoindex on;
        allow all;
        root /var/www/certbot/$host;
    }

    # See the nginx docker-compose.yml where we
    # provide this volume mapping to "static"
    location  /static/ {
        # Note: No rate limit
        autoindex on;
        allow all;
        alias  /static_root/;
        include  /etc/nginx/mime.types;
    }

    location / {
        # rate limit
        limit_req zone=all burst=30;
        limit_req zone=bots burst=10;
        try_files $uri @proxy_to_django;
    }

    location @proxy_to_django {
        proxy_pass http://django;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_redirect off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $server_name;

    }

    location /pgtileserv/ {
        proxy_pass http://mapas/;
        proxy_set_header Host            $host;
        proxy_set_header X-Forwarded-For $remote_addr;
    }
}