worker_processes 1;
pid /tmp/nginx.pid;
error_log /dev/stderr warn;

events {
    worker_connections 256;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    access_log /dev/stdout;
    server_tokens off;
    sendfile on;
    tcp_nopush on;
    keepalive_timeout 15s;
    client_max_body_size 1k;

    client_body_temp_path /tmp/client_temp;
    proxy_temp_path /tmp/proxy_temp;
    fastcgi_temp_path /tmp/fastcgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    scgi_temp_path /tmp/scgi_temp;

    # Dynamic dashboard is private to the Docker network.
    # Keep package catalogs/files served from local storage by nginx.
    server {
        listen 8080 default_server;
        server_name _;

        root /srv/repository;
        index index.html;
        autoindex off;

        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        add_header Referrer-Policy "no-referrer" always;

        if ($request_method !~ ^(GET|HEAD)$) {
            return 405;
        }

        location = /healthz {
            default_type text/plain;
            return 200 "ok\n";
        }

        # Actual site and its original /index.html link use the live dashboard.
        location = / {
            proxy_set_header X-Repo-Site linux;
            proxy_pass http://repository-dashboard:8000/;
        }
        location = /index.html {
            proxy_set_header X-Repo-Site linux;
            proxy_pass http://repository-dashboard:8000/index.html;
        }
        location ^~ /ui/ {
            proxy_pass http://repository-dashboard:8000;
        }
        location = /api/v1/packages {
            proxy_pass http://repository-dashboard:8000;
        }

        location ~ (^|/)\. {
            deny all;
        }

        location / {
            expires 10m;
            try_files $uri =404;
        }
    }

    # Separate OPNsense hostname/port, with native FreeBSD at /freebsd/.
    server {
        listen 8081;
        server_name _;

        root /srv/repository/opnsense;
        index index.html;
        autoindex off;

        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        add_header Referrer-Policy "no-referrer" always;

        if ($request_method !~ ^(GET|HEAD)$) {
            return 405;
        }

        location = /healthz {
            default_type text/plain;
            return 200 "ok\n";
        }

        location = / {
            proxy_set_header X-Repo-Site opnsense;
            proxy_pass http://repository-dashboard:8000/;
        }
        location = /index.html {
            proxy_set_header X-Repo-Site opnsense;
            proxy_pass http://repository-dashboard:8000/index.html;
        }
        location = /freebsd { return 301 /freebsd/; }
        location = /freebsd/ {
            proxy_set_header X-Repo-Site freebsd;
            proxy_pass http://repository-dashboard:8000/freebsd/;
        }
        location = /freebsd/index.html {
            proxy_set_header X-Repo-Site freebsd;
            proxy_pass http://repository-dashboard:8000/freebsd/index.html;
        }
        location ^~ /ui/ {
            proxy_pass http://repository-dashboard:8000;
        }
        location = /api/v1/packages {
            proxy_pass http://repository-dashboard:8000;
        }

        # Nginx still handles pkg catalog downloads directly, untouched.
        location /freebsd/ {
            alias /srv/repository/freebsd/;
            expires 10m;
            autoindex off;
        }

        location ~ (^|/)\. {
            deny all;
        }

        location / {
            expires 10m;
            try_files $uri =404;
        }
    }
}