map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

http {
    upstream funkwhale-api {
        server {{ env "FUNKWHALE_API_IP" }}:{{ env "FUNKWHALE_API_PORT" }};
    }

    server {
        listen 80;
        listen [::]:80;
        server_name {{ env "FUNKWHALE_HOSTNAME" }};
        location / { return 301 https://$host$request_uri; }

        add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:; worker-src 'self'";
        add_header Referrer-Policy "strict-origin-when-cross-origin";
        add_header X-Frame-Options "SAMEORIGIN" always;

        root {{ env "FUNKWHALE_FRONTEND_PATH" }};

        gzip on;
        gzip_comp_level    5;
        gzip_min_length    256;
        gzip_proxied       any;
        gzip_vary          on;

        gzip_types
            application/javascript
            application/vnd.geo+json
            application/vnd.ms-fontobject
            application/x-font-ttf
            application/x-web-app-manifest+json
            font/opentype
            image/bmp
            image/svg+xml
            image/x-icon
            text/cache-manifest
            text/css
            text/plain
            text/vcard
            text/vnd.rim.location.xloc
            text/vtt
            text/x-component
            text/x-cross-domain-policy;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host:$server_port;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_redirect off;

            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;

            client_max_body_size {{ env "NGINX_MAX_BODY_SIZE" }};
            proxy_pass   http://funkwhale-api/;
        }

        location /front/ {
            add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:; worker-src 'self'";
            add_header Referrer-Policy "strict-origin-when-cross-origin";
            add_header Service-Worker-Allowed "/";
            alias {{ env "FUNKWHALE_FRONTEND_PATH" }}/;
            expires 30d;
            add_header Pragma public;
            add_header Cache-Control "public, must-revalidate, proxy-revalidate";
        }
        location = /front/embed.html {
            add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; media-src 'self' data:; worker-src 'self'";
            add_header Referrer-Policy "strict-origin-when-cross-origin";

            add_header X-Frame-Options "" always;
            alias {{ env "FUNKWHALE_FRONTEND_PATH" }}/embed.html;
            expires 30d;
            add_header Pragma public;
            add_header Cache-Control "public, must-revalidate, proxy-revalidate";
        }

        location /federation/ {
            include /etc/nginx/funkwhale_proxy.conf;
            proxy_pass   http://funkwhale-api/federation/;
        }

        location /rest/ {
            include /etc/nginx/funkwhale_proxy.conf;
            proxy_pass   http://funkwhale-api/api/subsonic/rest/;
        }

        location /.well-known/ {
            include /etc/nginx/funkwhale_proxy.conf;
            proxy_pass   http://funkwhale-api/.well-known/;
        }

        location /media/ {
            alias {{ env "MEDIA_ROOT" }}/;
        }

        location /_protected/media/ {
            # this is an internal location that is used to serve
            # audio files once correct permission / authentication
            # has been checked on API side
            internal;
            alias   {{ env "MEDIA_ROOT" }};
        }

        # Comment the previous location and uncomment this one if you're storing
        # media files in a S3 bucket
        # location ~ /_protected/media/(.+) {
        #     internal;
        #     # Needed to ensure DSub auth isn't forwarded to S3/Minio, see #932
        #     proxy_set_header Authorization "";
        #     proxy_pass $1;
        # }

        location /_protected/music/ {
            # this is an internal location that is used to serve
            # audio files once correct permission / authentication
            # has been checked on API side
            # Set this to the same value as your MUSIC_DIRECTORY_PATH setting
            internal;
            alias   {{ env "MUSIC_DIRECTORY_SERVE_PATH" }};
        }

        location /staticfiles/ {
            alias {{ env "STATIC_ROOT" }}/;
        }
    }
}