kt_gr.conf

resolver 127.0.0.11 valid=2s;

server {
    listen 80;
    listen [::]:80;

    server_name ebau.local;

    rewrite ^/(.*)$ http://ember-ebau.local/$1 redirect;
}

server {
    listen 80;
    listen [::]:80;

    server_name ebau-portal.local;

    set $csp_use_google_fonts "true";
    set $csp_portal_allow_inline_style "true";
    set $csp_keycloak_url "http://ebau-keycloak.local";
    include conf.d/csp_headers.inc;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_redirect off;

    client_max_body_size 60m;

    location ~ ^/document-merge-service/ {
        add_header Content-Security-Policy $csp_header_api;
        proxy_pass http://document-merge-service:8000;
    }

    location ~ ^/alexandria/ {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/api/ {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/static/graphene_django {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/static/ {
        add_header Content-Security-Policy $csp_header_restricted;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/ech/ {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/graphql/ {
        # Graphql may have active graphiql in dev env, thus allow self-hosted CSS / images
        add_header Content-Security-Policy $csp_header_django;

        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/zips/ {
        add_header Content-Security-Policy $csp_header_restricted;
        internal;
        root /tmp/camac/tmpfiles;
    }
    location /maps/ {
        add_header Content-Security-Policy $csp_header_django;

        proxy_set_header Host map.geo.gr.ch;
        proxy_ssl_server_name on;
        proxy_redirect off;

        proxy_hide_header Access-Control-Allow-Origin;
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods GET;

        proxy_pass https://map.geo.gr.ch/;
    }

    location / {
        add_header Content-Security-Policy $csp_header_portal;
        set $ember http://ember-caluma-portal;
        proxy_pass $ember;
    }

}

server {
    listen 80;
    listen [::]:80;

    set $csp_use_google_fonts "true";
    set $csp_portal_allow_inline_style "true";
    set $csp_keycloak_url "http://ebau-keycloak.local";
    include conf.d/csp_headers.inc;

    server_name ember-ebau.local;

    chunked_transfer_encoding on;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_redirect off;
    proxy_buffering off;

    client_max_body_size 60m;

    location ~ ^/document-merge-service/ {
        add_header Content-Security-Policy $csp_header_api;

        proxy_pass http://document-merge-service:8000;
    }

    location ~ ^/alexandria/ {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/api/ {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/dav/ {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/static/graphene_django {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/static/ {
        add_header Content-Security-Policy $csp_header_restricted;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/ech/ {
        add_header Content-Security-Policy $csp_header_api;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/graphql/ {
        add_header Content-Security-Policy $csp_header_django;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/django/ {
        add_header Content-Security-Policy $csp_header_django;
        set $django http://django;
        proxy_pass $django;
    }

    location ~ ^/zips/ {
        internal;
        add_header Content-Security-Policy $csp_header_restricted;
        root /tmp/camac/tmpfiles;
    }

    # GWR API
    location /housing-stat/ {
        add_header Content-Security-Policy "default-src 'none'";
        proxy_set_header Host www-r.housing-stat.ch;
        proxy_ssl_server_name on;
        proxy_redirect off;
        add_header Content-Security-Policy $csp_header_api;

        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods 'GET, POST';

        proxy_pass https://www-r.housing-stat.ch/;
    }

    # MinIO admin console
    # https://min.io/docs/minio/linux/integrations/setup-nginx-proxy-with-minio.html
    location /minio/ui {
       add_header Content-Security-Policy $csp_header_restricted;
       rewrite ^/minio/ui/(.*) /$1 break;
       proxy_set_header Host $http_host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_set_header X-NginX-Proxy true;

       # This is necessary to pass the correct IP to be hashed
       real_ip_header X-Real-IP;

       proxy_connect_timeout 300;

       # To support websockets in MinIO versions released after January 2023
       proxy_http_version 1.1;
       proxy_set_header Upgrade $http_upgrade;
       proxy_set_header Connection "upgrade";

       chunked_transfer_encoding off;

       proxy_pass http://minio:9090;
    }

    location /maps/ {
       add_header Content-Security-Policy $csp_header_api;

        proxy_set_header Host map.geo.gr.ch;
        proxy_ssl_server_name on;
        proxy_redirect off;

        proxy_hide_header Access-Control-Allow-Origin;
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods GET;

        proxy_pass https://map.geo.gr.ch/;
    }

    location / {
        add_header Content-Security-Policy $csp_header_portal;
        set $ember http://ember-ebau;
        proxy_pass $ember;
    }

    location ~ ^/mailpit/ {
        add_header Content-Security-Policy $csp_header_portal;
        # https://mailpit.axllent.org/docs/configuration/proxy/
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        set $mailpit http://mailpit:8025;
        proxy_pass $mailpit;
    }
}

server {
    listen 80;
    listen [::]:80;

    set $csp_use_google_fonts "true";
    set $csp_portal_allow_inline_style "true";
    set $csp_keycloak_url "http://ebau-keycloak.local";
    include conf.d/csp_headers.inc;

    server_name ebau-keycloak.local;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_redirect off;

    # https://keycloak.discourse.group/t/nginx-reverse-proxy-shows-502-for-keycloak-registration-form-submission/10550
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;

    location / {
        add_header Content-Security-Policy $csp_header_keycloak;
        set $keycloak http://keycloak:8080;
        proxy_pass $keycloak;

        if ($request_method = 'OPTIONS') {
            # Tell client that this pre-flight info is valid for 20 days
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,x-csrftoken,x-requested-with';
            add_header 'Access-Control-Allow-Methods' 'GET,OPTIONS';
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain charset=UTF-8';
            add_header 'Content-Length' 0;
            return 204;
        }
    }
}