# NGINX default.conf file
# 
# Acts has a reverse proxy. 
# The strategy is to keep Angular and SpringBoot App no HTTP only.
# The NGINX will hide the APP, that will support only standard HTTP or HTTPS.
# The HTTPS will be configured only in NGINX. Making it more secure but also
# simplify the certificat configuration process.
# 
# General idea:
#   *1 User browser       : http://resilient.localhost
#   *2 NGINX redirects to : https://resilient.localhost
#   *3 NGINX redirects to : http://host.docker.internal:4200
# 
# The hostname : host.docker.internal, is the equivalent to localhost in the machine
# running the docker

# HTTP APP URL Configuration
# Listens to http://resilient.localhost 
#   if its a Let's encrypt challenge requests, points to certbot.
#   else redirects to https://resilient.localhost
server {
    listen       80;
    listen  [::]:80;
    server_name  resilient.localhost;

	# Listen to Let's Encrypt challenge requests. DON'T redirect to HTTPS
    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }
    
    # Redirect all other HTTP requests to HTTPS.
    # NOTE: To allow access to HTTP, comment this. Uncomment the location/
    return 301 https://$host$request_uri;
    
    # Uncomment this, to allow HTTP requests
    # location / {
    #     proxy_pass http://host.docker.internal:4200;
    #     proxy_set_header Host $host;
    #     proxy_set_header X-Real-IP $remote_addr;
    #     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #     proxy_set_header X-Forwarded-Proto $scheme;
    # }
}

# HTTPS APP URL Configuration
# Listens to https://resilient.localhost and proxies to http://localhost:8081
# Also defines SSL certificates.
server {
    listen       443 ssl;
    listen  [::]:443 ssl;
    server_name  resilient.localhost;

    #access_log  /var/log/nginx/host.access.log  main;

    ssl_certificate     /etc/nginx/certs/resilient_dev.crt;
    ssl_certificate_key /etc/nginx/certs/resilient_dev.key;
    
    # 👇 Use this for letsencrypt generated certificate
    # ssl_certificate     /etc/letsencrypt/live/innova.oguerreiro.com/fullchain.pem;
    # ssl_certificate_key /etc/letsencrypt/live/innova.oguerreiro.com/privkey.pem;
    
    location / {
        proxy_pass http://host.docker.internal:4200;
        
        # 👇 This skips cert verification, REQUIRED for self-signed certs
        #   Comment if it's NOT a self-signed cert
        proxy_ssl_verify off;
        
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    #
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}

# MOCK-IDP URL Configuration
# Listens to http://mock-idp.localhost and proxies to http://localhost:3000
server {
    listen       80;
    listen  [::]:80;
    server_name  mock-idp.localhost;

    #access_log  /var/log/nginx/host.access.log  main;

    location / {
        proxy_pass http://host.docker.internal:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    #error_page  404              /404.html;

    # redirect server error pages to the static page /50x.html
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}