worker_processes 1;
pid /home/gahow/projects/kanban/.nginx/nginx.pid;

events {
    worker_connections 512;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log /home/gahow/projects/kanban/.nginx/logs/access.log;
    error_log /home/gahow/projects/kanban/.nginx/logs/error.log warn;

    client_body_temp_path /home/gahow/projects/kanban/.nginx/client_body_temp;
    proxy_temp_path /home/gahow/projects/kanban/.nginx/proxy_temp;
    fastcgi_temp_path /home/gahow/projects/kanban/.nginx/fastcgi_temp;
    uwsgi_temp_path /home/gahow/projects/kanban/.nginx/uwsgi_temp;
    scgi_temp_path /home/gahow/projects/kanban/.nginx/scgi_temp;

    limit_req_zone $binary_remote_addr zone=kanban_login_user:10m rate=5r/m;

    server {
        listen 8443 ssl;
        server_name gahow-pc.ipads-lab.se.sjtu.edu.cn;

        ssl_certificate /home/gahow/projects/kanban/deploy/certs/local-kanban.crt;
        ssl_certificate_key /home/gahow/projects/kanban/deploy/certs/local-kanban.key;
        ssl_protocols TLSv1.2 TLSv1.3;

        add_header Strict-Transport-Security "max-age=31536000" always;
        add_header X-Frame-Options "DENY" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header Referrer-Policy "no-referrer" always;

        client_max_body_size 1m;

        location = /api/auth/login {
            limit_req zone=kanban_login_user burst=5 nodelay;
            proxy_pass http://127.0.0.1:5180;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
        }

        location / {
            proxy_pass http://127.0.0.1:5180;
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
        }
    }
}