---
apiVersion: v1
kind: ConfigMap
metadata:
  name: '{{ ansible_operator_meta.name }}-{{ deployment_type }}-configmap'
  namespace: '{{ ansible_operator_meta.namespace }}'
  labels:
    app.kubernetes.io/name: 'nginx'
    app.kubernetes.io/instance: 'nginx-{{ ansible_operator_meta.name }}'
    app.kubernetes.io/component: webserver
    app.kubernetes.io/part-of: '{{ deployment_type }}'
    app.kubernetes.io/managed-by: '{{ deployment_type }}-operator'
data:
  nginx_conf: |
    error_log /dev/stdout info;
    worker_processes 1;
    events {
        worker_connections 1024;  # increase if you have lots of clients
        accept_mutex off;  # set to 'on' if nginx worker_processes > 1
    }

    http {
        access_log /dev/stdout;
        include mime.types;
        # fallback in case we can't determine a type
        default_type application/octet-stream;
        sendfile on;

        # If left at the default of 1024, nginx emits a warning about being unable
        # to build optimal hash types.
        types_hash_max_size 4096;

        upstream pulp-content {
            server {{ ansible_operator_meta.name }}-content-svc:24816;
        }

        upstream pulp-api {
            server {{ ansible_operator_meta.name }}-api-svc:24817;
        }

        {% if route_tls_termination_mechanism | lower == 'passthrough' %}
        server {
            listen 8080 default_server;
            server_name _;

            # Redirect all HTTP links to the matching HTTPS page
            return 301 https://$host$request_uri;
        }
        {% endif %}

        server {
        {% if route_tls_termination_mechanism | lower == 'passthrough' %}
            listen 8443 default_server deferred ssl;
            listen [::]:8443 default_server deferred ssl;

            ssl_certificate /etc/nginx/pki/web.crt;
            ssl_certificate_key /etc/nginx/pki/web.key;
            ssl_session_cache shared:SSL:50m;
            ssl_session_timeout 1d;
            ssl_session_tickets off;

            # intermediate configuration
            ssl_protocols TLSv1.2;
            ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
            ssl_prefer_server_ciphers on;
        {% else %}
            # Gunicorn docs suggest the use of the "deferred" directive on Linux.
            listen 8080 default_server deferred;
            listen [::]:8080 default_server deferred;
        {% endif %}

            # If you have a domain name, this is where to add it
            server_name $hostname;

            # The default client_max_body_size is 1m. Clients uploading
            # files larger than this will need to chunk said files.
            client_max_body_size {{ nginx_client_max_body_size }};

            # Gunicorn docs suggest this value.
            keepalive_timeout 5;

            # static files that can change dynamically, or are needed for TLS
            # purposes are served through the webserver.
            root {{ pulp_webserver_static_dir }};

            location /pulp/content/ {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header Host $http_host;
                # we don't want nginx trying to do something clever with
                # redirects, we set the Host: header above already.
                proxy_redirect off;
                proxy_pass http://pulp-content;
            }

            location /pulp/api/v3/ {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header Host $http_host;
                # we don't want nginx trying to do something clever with
                # redirects, we set the Host: header above already.
                proxy_redirect off;
                proxy_pass http://pulp-api;
            }

            location /auth/login/ {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header Host $http_host;
                # we don't want nginx trying to do something clever with
                # redirects, we set the Host: header above already.
                proxy_redirect off;
                proxy_pass http://pulp-api;
            }

            include {{ pulp_nginx_conf_dir }}/*.conf;

            location / {
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;
                proxy_set_header Host $http_host;
                # we don't want nginx trying to do something clever with
                # redirects, we set the Host: header above already.
                proxy_redirect off;
                proxy_pass http://pulp-api;
                # static files are served through whitenoise - http://whitenoise.evans.io/en/stable/
            }
        }
    }
