# vim: set et sts=4 sw=4 ts=4:
user www-data;
worker_processes auto;
pid /run/nginx.pid;

error_log /dev/stderr warn;

events {
    worker_connections 768;
}

http {
    sendfile on;
    tcp_nopush on;
    keepalive_timeout  65;
    types_hash_max_size 2048;
    server_tokens off;

    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    client_max_body_size 32M;
    client_body_buffer_size 32M;
    proxy_max_temp_file_size 0;

    server {
        listen unix:/var/run/nginx.sock;
        server_name localhost;

        location / {
            proxy_pass http://127.0.0.1:8112/;
            add_header X-Frame-Options SAMEORIGIN;

            # this is NOT authentication (it is in a public git repository
            # after all), it is only meant to avoid automatic scans
            if ($cookie_preauth != "correct horse battery staple") {
                return 404;
            }
        }

        location /download/ {
            alias /download/;
            autoindex on;
            auth_basic "go away";
            auth_basic_user_file /config/htpasswd;
        }

        location /metrics {
            proxy_pass http://0.0.0.0:9354/metrics;
            auth_basic "go away";
            auth_basic_user_file /config/htpasswd;
        }
    }
}