# Worker stays unprivileged as the image's default "nginx" user, but gains the "root" group so
# it can read /var/www/userfiles - backend-b (running as root) writes those with
# FILE_UPLOAD_DIRECTORY_PERMISSIONS=0750, group-readable but not world-readable. Mirrors
# deploy/prod/playbook.yml's "Allow nginx to read backend user files" (www-data joins the
# backend's file-owning group instead of loosening the mode).
user nginx root;

events {}

http {
   client_max_body_size 128M;

    upstream backend {
        server backend-b:8000;
    }

    server {

        listen 8080 ssl;
        server_name localhost;

        ssl_certificate /etc/nginx/nginx.crt;
        ssl_certificate_key /etc/nginx/nginx.key;

        location /api {
            #proxy_set_header X-Forwarded-For "$http_x_forwarded_for, $realip_remote_addr";
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host:$server_port;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_pass http://backend;
        }

        location /auth {
            #proxy_set_header X-Forwarded-For "$http_x_forwarded_for, $realip_remote_addr";
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host:$server_port;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_pass http://backend;
        }

        location /media {
            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host:$server_port;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_pass http://backend;
        }

        location /redirect_media/ {
            internal;
            alias /var/www/userfiles/;
            # This location serves the file directly, bypassing Django (and therefore
            # django-cors-headers) entirely - it's the target of the X-Accel-Redirect
            # response from files/media_urls.py, used when SERVE_X_ACCEL_REDIRECT=True.
            # CORS headers must be added here explicitly since nothing else will.
            add_header 'Access-Control-Allow-Origin' '*' always;
            add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
            add_header 'Access-Control-Allow-Headers' 'Authorization, Accept, Content-Type, Origin, User-Agent' always;
        }

        location /docs {
            proxy_pass http://backend/docs;
        }

        location /static {
            proxy_pass http://backend/static;
        }
    }
}