# keep in sync with services/clsi/nginx.conf
# Changes to the above:
#  - added Security-Headers
#  - remove CORS rules, Server-CE/Server-Pro runs behind a single origin
#  - change /output path to /var/lib/overleaf/data/output
#  - remove tiny.pdf endpoints

server {
  add_header 'X-Served-By' 'clsi-nginx' always;

  # Security-Headers
  add_header 'X-Content-Type-Options' 'nosniff' always;
  add_header 'X-Download-Options' 'noopen' always;
  add_header 'X-Frame-Options' 'SAMEORIGIN' always;
  add_header 'X-XSS-Protection' '1; mode=block' always;

  listen 8080;
  server_name clsi-nginx;
  server_tokens off;
  access_log off;
  # Ignore symlinks possibly created by users
  disable_symlinks on;
  # enable compression for text-based output: tex auxiliary files, logs, and
  # HTML/CSS/JS (RevealJS presentations). Already-compressed formats (pdf,
  # png/jpeg/webp, woff/woff2) are deliberately omitted to avoid wasting CPU.
  gzip on;
  gzip_types text/plain text/html text/css application/javascript application/json image/svg+xml;
  gzip_proxied any;
  # only compress responses worth compressing
  gzip_min_length 1024;
  types {
      text/html                  html htm;
      text/css                   css;
      application/javascript     js;
      application/json           json;
      image/svg+xml              svg svgz;
      image/png                  png;
      image/jpeg                 jpeg jpg;
      image/gif                  gif;
      image/webp                 webp;
      font/woff                  woff;
      font/woff2                 woff2;
      application/pdf            pdf;
      text/plain                 log blg aux stdout stderr txt;
  }
  # handle output files for specific users
  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/(.+)$ {
    rewrite ^/project/([0-9a-f]+)/user/([0-9a-f]+)/build/([0-9a-f-]+)/output/(.+)$ /$4 break;
    root /var/lib/overleaf/data/output/$1-$2/generated-files/$3/;
  }
  # handle output files for anonymous users
  location ~ ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/(.+)$ {
    rewrite ^/project/([0-9a-f]+)/build/([0-9a-f-]+)/output/(.+)$ /$3 break;
    root /var/lib/overleaf/data/output/$1/generated-files/$2/;
  }

  # PDF range for specific users
  location ~ ^/project/([0-9a-f]+)/user/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
    # Cache for one day
    expires 1d;
    alias /var/lib/overleaf/data/output/$1-$2/content/$3;
  }
  # PDF range for anonymous users
  location ~ ^/project/([0-9a-f]+)/content/([0-9a-f-]+/[0-9a-f]+)$ {
    # Cache for one day
    expires 1d;
    alias /var/lib/overleaf/data/output/$1/content/$2;
  }

  # Do not look up any non matching files in the default root.
  location / {
    return 404;
  }
}