worker_processes 1;
pid /tmp/nginx.pid;
error_log /dev/stderr warn;

events {
    worker_connections 256;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log /dev/stdout;
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    keepalive_timeout 15s;
    client_max_body_size 1k;

    client_body_temp_path /tmp/client_temp;
    proxy_temp_path /tmp/proxy_temp;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;

    # Linux APT/RPM repository.
    server {
        listen 8080 default_server;
        server_name _;

        root /srv/repository;
        index index.html;
        autoindex off;

        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        add_header Referrer-Policy "no-referrer" always;
        add_header Cache-Control "max-age=600" always;
        
        if ($request_method !~ ^(GET|HEAD)$) {
            return 405;
        }

        location = /healthz {
            default_type text/plain;
            return 200 "ok\n";
        }

        location = / {
            try_files /index.html @linux_initializing;
        }

        location @linux_initializing {
            default_type text/html;
            return 200 '<!doctype html><html><head><meta charset="utf-8"><title>RustProxy repository</title></head><body><h1>RustProxy Linux repository</h1><p>Repository is being initialized.</p></body></html>';
        }

        location ~ (^|/)\. {
            deny all;
        }

        location / {
            try_files $uri =404;
        }
    }

    # OPNsense/FreeBSD pkg repository. It has a separate public URL and local port,
    # but follows the same atomic repository/current switch as the Linux repo.
    server {
        listen 8081;
        server_name _;

        root /srv/repository/opnsense;
        index index.html;
        autoindex off;

        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        add_header Referrer-Policy "no-referrer" always;
        add_header Cache-Control "max-age=600" always;

        if ($request_method !~ ^(GET|HEAD)$) {
            return 405;
        }

        location = /healthz {
            default_type text/plain;
            return 200 "ok\n";
        }

        location = / {
            try_files /index.html @opnsense_initializing;
        }

        location @opnsense_initializing {
            default_type text/html;
            return 200 '<!doctype html><html><head><meta charset="utf-8"><title>RustProxy OPNsense repository</title></head><body><h1>RustProxy OPNsense repository</h1><p>Repository is being initialized.</p></body></html>';
        }

        location ~ (^|/)\. {
            deny all;
        }

        location / {
            try_files $uri =404;
        }
    }
}