# This file is part of IVRE.
# Copyright 2011 - 2023 Pierre LALET <pierre@droids-corp.org>
#
# IVRE is free software: you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# IVRE is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public
# License for more details.
#
# You should have received a copy of the GNU General Public License
# along with IVRE. If not, see <http://www.gnu.org/licenses/>.

server {
    listen 80 default_server;

    root /usr/local/share/ivre/web/static/;
    index index.html index.htm index.php;

    server_name localhost;

    location / {
        # First attempt to serve request as file, then
        # as directory, then fall back to displaying a 404.
        try_files $uri $uri/ =404;
        # Clickjacking protection for static pages (login, admin, etc.)
        add_header X-Frame-Options "DENY" always;
        add_header Content-Security-Policy "frame-ancestors 'none'" always;
    }

    # Doc pages are displayed in an iframe within the app, so they
    # must not have X-Frame-Options. This overrides location / for
    # the /doc/ prefix.
    location /doc/ {
        try_files $uri $uri/ =404;
    }

    location /cgi/ {
        include uwsgi_params;
        uwsgi_pass ivreuwsgi:3031;
        uwsgi_param REMOTE_USER $remote_user;
        uwsgi_param HTTP_User_Agent "";
    }

    # Auth subrequest for nginx auth_request (internal only)
    location = /cgi/auth/check {
        internal;
        include uwsgi_params;
        uwsgi_pass ivreuwsgi:3031;
        uwsgi_pass_request_body off;
        uwsgi_param REQUEST_METHOD GET;
        uwsgi_param CONTENT_LENGTH "";
        uwsgi_param HTTP_User_Agent "";
    }

    # IVRE MCP server (Streamable-HTTP transport). FastMCP /
    # Starlette registers a single Route("/mcp") as the canonical
    # path. Use an exact-match location (not a regex) so that
    # `proxy_pass` may carry a URI part; only the canonical
    # "/mcp" is exposed (no "/mcp/"). Streamable-HTTP relies on
    # server-sent events: buffering must be off and read/send
    # timeouts must be generous.
    location = /mcp {
        proxy_pass              http://ivremcp:9100/mcp;
        proxy_http_version      1.1;
        proxy_set_header        Host              $host;
        proxy_set_header        X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_set_header        Authorization     $http_authorization;
        proxy_buffering         off;
        proxy_cache             off;
        proxy_read_timeout      1h;
        proxy_send_timeout      1h;
        chunked_transfer_encoding on;
    }

    location ~ ^/dokuwiki/.*\.php$ {
        auth_request /cgi/auth/check;
        auth_request_set $auth_user $upstream_http_x_auth_user;
        error_page 401 = @login_redirect;

        root /var/www/;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass ivredoku:8000;
        fastcgi_index index.php;
        fastcgi_param PHP_AUTH_USER $auth_user;
        fastcgi_param REMOTE_USER $auth_user;
        include fastcgi.conf;
    }

    location /dokuwiki/ {
        auth_request /cgi/auth/check;
        error_page 401 = @login_redirect;
        root /var/www/;
        try_files $uri $uri/ @dokuwiki;
    }

    location @login_redirect {
        return 302 /login.html;
    }

    location @dokuwiki {
        root /var/www/;
        rewrite ^/dokuwiki/_media/(.*) /dokuwiki/lib/exe/fetch.php?media=$1 last;
        rewrite ^/dokuwiki/_detail/(.*) /dokuwiki/lib/exe/detail.php?media=$1 last;
        rewrite ^/dokuwiki/_export/([^/]+)/(.*) /dokuwiki/doku.php?do=export_$1&id=$2 last;
        rewrite ^/dokuwiki/(.*) /dokuwiki/doku.php?id=$1 last;
    }

    # deny access to .htaccess files, if Apache's document root
    # concurs with nginx's one
    #
    location ~ ^/dokuwiki/((data|conf|bin|inc(/lang)?)/)?\.ht {
        deny all;
    }

    location ~ ^/dokuwiki/(data|conf|bin|inc)/ {
        deny all;
    }
}
