kt_so.conf

resolver 127.0.0.11 valid=2s;

server {
    listen 80;
    listen [::]:80;

    server_name ebau.local;

    rewrite ^/(.*)$ http://ember-ebau.local/$1 redirect;
}

# This is a dummy eGov portal used for testing the token exchange feature
# locally.
server {
    listen 80;
    listen [::]:80;

    server_name egov.local;
    root /usr/share/nginx/html;
    index index.html;

    location / {
        try_files $uri $uri/ /index.html?/$request_uri;
    }
}

server {
    listen 80;
    listen [::]:80;

    server_name ebau-portal.local;

    set $csp_portal_allow_inline_style "true";
    set $csp_keycloak_url "http://ebau-keycloak.local";
    set $csp_external_img_sources "http://ember-ebau.local https://geo-i.so.ch";
    set $csp_external_connect_sources "https://api3.geo.admin.ch";
    include conf.d/csp_headers.inc;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_redirect off;

    client_max_body_size 100m;

    # API
    location ~ ^/(api|graphql|alexandria)/ {
        add_header Content-Security-Policy $csp_header_api;

        set $django http://django;
        proxy_pass $django;
    }

    # Code-generated files
    location ~ ^/tmp/ {
        add_header Content-Security-Policy $csp_header_restricted;

        internal;
        root /tmp/camac/tmpfiles;
    }

    location / {
        add_header Content-Security-Policy $csp_header_portal;

        set $ember http://ember-caluma-portal;
        proxy_pass $ember;
    }

}

server {
    listen 80;
    listen [::]:80;

    server_name ember-ebau.local;

    set $csp_portal_allow_inline_style "true";
    set $csp_keycloak_url "http://ebau-keycloak.local";
    set $csp_external_img_sources "https://geo-i.so.ch https://validator.swagger.io";
    set $csp_external_connect_sources "https://api3.geo.admin.ch";
    include conf.d/csp_headers.inc;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_redirect off;

    client_max_body_size 100m;

    # Upload max size for import files
    location ~ ^/api/v1/dossier-imports {
        add_header Content-Security-Policy $csp_header_api;

        client_max_body_size 1000m;
        proxy_connect_timeout 180;
        proxy_read_timeout 180;
        proxy_send_timeout 180;

        set $django http://django;
        proxy_pass $django;
    }

    # Django admin & eCH-0211 swagger docs
    location ~ ^/(django|api/swagger)/ {
        add_header Content-Security-Policy $csp_header_django;

        set $django http://django;
        proxy_pass $django;
    }

    # API
    location ~ ^/(api|ech|graphql|alexandria|static|dav)/ {
        add_header Content-Security-Policy $csp_header_api;

        set $django http://django;
        proxy_pass $django;
    }

    # MinIO ebau bucket
    location ~ ^/ebau-media {
        add_header Content-Security-Policy $csp_header_restricted;

        client_max_body_size 150M;
        proxy_buffering off;
        proxy_set_header Host $http_host;
        set $minio http://minio:9000;
        proxy_pass $minio;
    }

    # DMS API
    location ~ ^/document-merge-service/ {
        add_header Content-Security-Policy $csp_header_api;

        # Add trailing slash so the path is not forwarded to the host. However,
        # because of that we can't use a variable as host like in the other
        # locations.
        proxy_pass http://document-merge-service:8000;
    }

    # Code-generated files
    location ~ ^/tmp/ {
        add_header Content-Security-Policy $csp_header_restricted;

        internal;
        root /tmp/camac/tmpfiles;
    }

    # Mailpit
    location ~ ^/mailpit/ {
        add_header Content-Security-Policy $csp_header_portal;

        # https://mailpit.axllent.org/docs/configuration/proxy/
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";

        set $mailpit http://mailpit:8025;
        proxy_pass $mailpit;
    }

    # GWR API
    location /housing-stat/ {
        add_header Content-Security-Policy $csp_header_api;

        proxy_set_header Host www-r.housing-stat.ch;
        proxy_ssl_server_name on;
        proxy_redirect off;

        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods 'GET, POST';

        proxy_pass https://www-r.housing-stat.ch/;
    }

    location / {
        add_header Content-Security-Policy $csp_header_portal;

        set $ember http://ember-ebau;
        proxy_pass $ember;
    }

}

server {
    listen 80;
    listen [::]:80;

    server_name ebau-keycloak.local;

    set $csp_portal_allow_inline_style "true";
    set $csp_keycloak_url "http://ebau-keycloak.local";
    include conf.d/csp_headers.inc;

    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_redirect off;

    # https://keycloak.discourse.group/t/nginx-reverse-proxy-shows-502-for-keycloak-registration-form-submission/10550
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;

    location / {
        add_header Content-Security-Policy $csp_header_keycloak;

        set $keycloak http://keycloak:8080;
        proxy_pass $keycloak;

        if ($request_method = 'OPTIONS') {
            # Tell client that this pre-flight info is valid for 20 days
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Headers' 'Authorization,Content-Type,x-csrftoken,x-requested-with';
            add_header 'Access-Control-Allow-Methods' 'GET,OPTIONS';
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain charset=UTF-8';
            add_header 'Content-Length' 0;
            return 204;
        }
    }
}