# Copyright 2024 RustFS Team
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

worker_processes auto;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log warn;

    sendfile on;
    keepalive_timeout 65;

    # RustFS Server Block
    server {
        listen 80;
        server_name localhost;

        # Redirect HTTP to HTTPS (optional, uncomment if SSL is configured)
        # return 301 https://$host$request_uri;

        location / {
            proxy_pass http://rustfs:9000;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;

            # S3 specific headers
            proxy_set_header X-Amz-Date $http_x_amz_date;
            proxy_set_header Authorization $http_authorization;

            # Disable buffering for large uploads
            proxy_request_buffering off;
            client_max_body_size 0;
        }

        location /rustfs/console {
            proxy_pass http://rustfs:9001;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }

    # SSL Configuration (Example)
    # server {
    #     listen 443 ssl;
    #     server_name localhost;
    #
    #     ssl_certificate /etc/nginx/ssl/server.crt;
    #     ssl_certificate_key /etc/nginx/ssl/server.key;
    #
    #     # Restrict to modern TLS versions and ciphers. Operators copying this
    #     # example must keep at least these directives — without them, nginx
    #     # may negotiate older protocol versions that have known weaknesses.
    #     ssl_protocols TLSv1.2 TLSv1.3;
    #     ssl_prefer_server_ciphers on;
    #     ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
    #     ssl_session_timeout 1d;
    #     ssl_session_cache shared:SSL:10m;
    #     ssl_session_tickets off;
    #     # add_header Strict-Transport-Security "max-age=63072000" always;
    #
    #     location / {
    #         proxy_pass http://rustfs:9000;
    #         ...
    #     }
    # }
}