# openssl req -x509 -newkey rsa:4096 -nodes -keyout ./nginx/ssl/https.key -out ./nginx/ssl/https.crt -days 3650 -subj "/C=US/ST=Florida/L=Miami/O=@videonetics"

upstream stream_service {
   server 127.0.0.1:8083;
}

upstream cache_service {
   server 127.0.0.1:8084;
}

upstream metadata_service_proxy {
   server 127.0.0.1:20004;
}

upstream stream_service_proxy {
   least_conn;
   zone stream_service_proxy 100M;
   server 127.0.0.1:20003;
}

map $http_upgrade $connection_upgrade {
   default upgrade;
   '' close;
}

# HTTP server

server {
   # Binds the TCP port 7080.
   listen 80;
   listen [::]:80;
   # Defines the domain or subdomain name.
   # If no server_name is defined in a server block then
   # Nginx uses the 'empty' name

   # Redirect the traffic to the corresponding
   # HTTPS server block with status code 301
   return 301 https://$host:443$request_uri;
}


# HTTPS server
server {
   # SSL configuration

   listen 443 ssl http2;
   listen [::]:443 ssl http2;

   server_name soterixcloud.com;

    ssl_certificate		/etc/nginx/ssl/soterixcloud.pem;
    # ssl_certificate		/etc/nginx/ssl/videonetics.crt;
    ssl_certificate_key	/etc/nginx/ssl/soterixcloud.key;
    
   # ssl_session_timeout 1d;
   # ssl_session_cache   shared:SharedNixCraftSSL:10m;
   # ssl_session_tickets off;

   # TLS 1.3 only
   ssl_protocols TLSv1.3;
   ssl_prefer_server_ciphers off;

   # OCSP stapling
   ssl_stapling on;
   ssl_stapling_verify on;

   # # verify chain of trust of OCSP response using Root CA and Intermediate certs
   # # ssl_trusted_certificate /etc/nginx/ssl/fullchain.pem;

   # client_max_body_size        10G;
   location /metadata_service. {

      grpc_pass grpc://metadata_service_proxy;

      error_page 502 = /error502grpc;

   }

   location /stream_service. {

      grpc_pass grpc://stream_service_proxy;

      error_page 502 = /error502grpc;

   }

   location /api/ws {
      proxy_pass http://stream_service;

      # enables WS support
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      proxy_send_timeout 7200;
      proxy_read_timeout 7200;
      send_timeout 7200;
      proxy_connect_timeout 1s;
      proxy_set_header Host $host;
   }

   location /v3/api/ws {
      proxy_pass http://stream_service;

      # enables WS support
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      proxy_send_timeout 7200;
      proxy_read_timeout 7200;
      send_timeout 7200;
      proxy_connect_timeout 1s;
      proxy_set_header Host $host;
   }

   location /v2/stream {
      proxy_pass http://stream_service;

      # enables WS support
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      proxy_send_timeout 7200;
      proxy_read_timeout 7200;
      send_timeout 7200;
      proxy_connect_timeout 1s;
      proxy_set_header Host $host;
   }

   location /ws/timeline {
      proxy_pass http://cache_service;

      # enables WS support
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      proxy_send_timeout 600;
      proxy_read_timeout 600;
      send_timeout 600;
      proxy_connect_timeout 1s;
      proxy_set_header Host $host;
   }

   location = /error502grpc {

      internal;

      default_type application/grpc;

      add_header grpc-status 14;

      add_header grpc-message “unavailable”;

      return 204;

   }

}
