chroma-manager.conf.template

map $ssl_client_s_dn $ssl_client_s_dn_cn {
    default "";
    ~CN=(?<CN>[^,]+) $CN;
}

map $status $loggable {
    ~^[23]  0;
    default 1;
}

server {
    listen {{HTTPS_FRONTEND_PORT}} ssl http2;

    error_page 497 https://$http_host$request_uri;

    proxy_read_timeout 330s;

    access_log /var/log/nginx/access.log combined if=$loggable;

    types {
        text/html html htm;
        text/css css;
        text/xml xml rss;
        image/gif gif;
        image/jpeg jpeg jpg;
        application/javascript js;
        application/json json map
        text/plain txt;
        text/x-component htc;
        image/png png;
        image/x-icon ico;
        application/x-shockwave-flash swf
        application/x-makeself run;
        application/x-pilot prc pdb;
        application/x-rar-compressed rar;
        application/x-redhat-package-manager rpm;
        application/x-tcl tcl tk;
        application/x-x509-ca-cert der pem crt;
        application/x-xpinstall xpi;
        application/zip zip;
        application/octet-stream deb;
        application/octet-stream bin exe dll;
        application/octet-stream dmg;
        application/octet-stream eot;
        application/octet-stream iso img;
        application/octet-stream msi msp msm;
        application/font-woff woff;
        application/wasm wasm;
    }

    ssl_certificate {{SSL_PATH}}/manager.crt;
    ssl_certificate_key {{SSL_PATH}}/manager.pem;
    ssl_trusted_certificate {{SSL_PATH}}/authority.crt;
    ssl_client_certificate {{SSL_PATH}}/authority.crt;
    ssl_verify_client optional;
    ssl_protocols TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:!DH+3DES:!ADH:!AECDH:!RC4:!aNULL:!MD5';

    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 180m;

    gzip_comp_level 2;

    location /favicon.ico {
      alias /usr/lib/iml-manager/iml-gui/favicon.ico;
    }

    location /certificate/ {
        return 301 https://$http_host/certificate;
    }

    location /certificate {
        alias {{SSL_PATH}}/authority.crt;
        types {}
        default_type application/octet-stream;
        add_header Content-disposition "attachment; filename=download.cer";
    }

    location ~ ^/$ {
        return 301 https://$http_host/ui;
    }

    location /help {
        alias /usr/lib/iml-manager/iml-online-help;

        gzip on;
        gzip_types text/plain text/xml text/css application/x-javascript application/javascript text/javascript application/json;

        index index.html;
    }

    location /gui/node_modules/socket-worker/dist {
        alias /usr/lib/node_modules/@iml/socket-worker/targetdir;

        etag on;
        expires 1y;
        add_header Cache-Control "public";

        gzip on;
        gzip_types application/x-javascript application/javascript text/javascript;
    }

    location /gui {
        alias /usr/lib/iml-manager/iml-gui;

        etag on;
        expires 1y;
        add_header Cache-Control "public";

        gzip on;
        gzip_types text/plain text/xml text/css application/x-javascript application/javascript text/javascript application/json;
    }

    location /old-gui {
        alias /usr/lib/node_modules/@iml/old-gui/static;

        etag on;
        expires 1y;
        add_header Cache-Control "public";

        gzip on;
        gzip_types text/plain text/xml text/css application/x-javascript application/javascript text/javascript application/json;
    }

    location /ui {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{VIEW_SERVER_PROXY_PASS}}/ui;

        add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; ";

        gzip on;
    }

    location /wasm-components {
        alias /usr/share/iml-manager/iml-wasm-components;

        etag on;
        expires 1y;
        add_header Cache-Control "public";

        gzip on;
        gzip_types text/css application/x-javascript application/javascript text/javascript application/json application/wasm;
    }

    location /api {
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{HTTP_API_PROXY_PASS}}/api;
    }

    location /socket.io {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{REALTIME_PROXY_PASS}}/socket.io;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /messaging {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_pass {{WARP_DRIVE_PROXY_PASS}};
    }

    location /agent/register {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{HTTP_AGENT_PROXY_PASS}}/agent/register;
    }

    location /agent/setup {
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{HTTP_AGENT_PROXY_PASS}}/agent/setup;
    }

    location /agent/reregister {
        if ($ssl_client_verify != SUCCESS) {
            return 401;
        }

        proxy_set_header X-SSL-Client-On $ssl_client_verify;
        proxy_set_header X-SSL-Client-Name $ssl_client_s_dn_cn;
        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;

        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{HTTP_AGENT_PROXY_PASS}}/agent/reregister;
    }

    location /agent/message {
        client_body_buffer_size 1m;
        client_max_body_size 8m;

        if ($ssl_client_verify != SUCCESS) {
            return 401;
        }

        proxy_set_header X-SSL-Client-On $ssl_client_verify;
        proxy_set_header X-SSL-Client-Name $ssl_client_s_dn_cn;
        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;

        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{HTTP_AGENT_PROXY_PASS}}/agent/message;
    }

    location /agent2/message {
        if ($ssl_client_verify != SUCCESS) {
            return 401;
        }

        proxy_set_header X-SSL-Client-On $ssl_client_verify;
        proxy_set_header X-SSL-Client-Name $ssl_client_s_dn_cn;
        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;

        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{HTTP_AGENT2_PROXY_PASS}}/message;
    }

    location /agent/copytool_event {
        if ($ssl_client_verify != SUCCESS) {
            return 401;
        }

        proxy_set_header X-SSL-Client-On $ssl_client_verify;
        proxy_set_header X-SSL-Client-Name $ssl_client_s_dn_cn;
        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;

        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass {{HTTP_AGENT_PROXY_PASS}}/agent/copytool_event;
    }

    location /repo/ {
        if ($ssl_client_verify != SUCCESS) {
            return 401;
        }

        proxy_set_header X-SSL-Client-On $ssl_client_verify;
        proxy_set_header X-SSL-Client-Name $ssl_client_s_dn_cn;

        autoindex on;
        alias {{REPO_PATH}}/;
    }

    location /client/ {
        autoindex on;
        alias {{REPO_PATH}}/lustre-client/;
    }

    location /iml-srcmap-reverse {
        proxy_pass {{SRCMAP_REVERSE_PROXY_PASS}};
    }

    location /iml-device-aggregator {
        if ($ssl_client_verify != SUCCESS) {
            return 401;
        }

        proxy_set_header X-SSL-Client-On $ssl_client_verify;
        proxy_set_header X-SSL-Client-Name $ssl_client_s_dn_cn;
        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;

        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Http-Host      $http_host;
        proxy_pass {{DEVICE_AGGREGATOR_PROXY_PASS}};
    }

    location /iml_has_package_updates {
        if ($ssl_client_verify != SUCCESS) {
            return 401;
        }

        proxy_set_header X-SSL-Client-On $ssl_client_verify;
        proxy_set_header X-SSL-Client-Name $ssl_client_s_dn_cn;
        proxy_set_header X-SSL-Client-Serial $ssl_client_serial;

        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Http-Host      $http_host;
        proxy_pass {{UPDATE_HANDLER_PROXY_PASS}};
    }
}

server {
    listen 127.0.0.1:{{DEVICE_AGGREGATOR_PORT}};

    location /device-aggregator {
        proxy_pass {{DEVICE_AGGREGATOR_PROXY_PASS}};
    }
}