# Don't leak our Nginx version to clients:
server_tokens off;

upstream django {
  # fail_timeout=0 means we always retry an upstream even if it failed
  # to return a good HTTP response (in case the Unicorn master nukes a
  # single worker for timing out).

  server unix:/var/run/django/gunicorn.sock fail_timeout=0;
}

server {
    # Block requests with invalid HTTP_HOST header, eg. bots querying us by IP.
    # This in particular fixes Django's error emails "Invalid HTTP_HOST header".
    listen 80;
    include includes/ssl;
    return 400;
}

server {
    listen 80;
    include includes/server-name;
    return 301 https://$host$request_uri;
}

log_format combined_timed '$remote_addr - $remote_user [$time_local] '
                          '"$request" $status $body_bytes_sent '
                          '"$http_referer" "$http_user_agent" '
                          '$request_time';

server {
    include includes/ssl;
    include includes/server-name;

    # Allow file uploads up to 4 GB:
    client_max_body_size 4096m;

    access_log /var/log/nginx-access.log combined_timed;
    error_log /var/log/nginx-error.log;

    location /static/ {
        alias /srv/static/;
    }

    location /media/ {
        alias /srv/media/;
    }

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
        proxy_redirect off;
        if (!-f $request_filename) {
            proxy_pass http://django;
            break;
        }
    }
}