user www-nginx;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
	worker_connections 768;
	# multi_accept on;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	types_hash_max_size 2048;

    #gzip  on;

    # set plaintext data to UTF-8
    charset utf-8;
    charset_types text/plain;

    ssl_ciphers HIGH:!CBC:!aNULL:!MD5;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 180m;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    # resolver 8.8.8.8 8.8.4.4 valid=300s; # Google DNS Servers
    # resolver_timeout 5s;
    resolver 147.251.48.3;

    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

	##
	# Logging Settings
	##

	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	##
	# Gzip Settings
	##

	gzip on;

	# gzip_vary on;
	# gzip_proxied any;
	# gzip_comp_level 6;
	# gzip_buffers 16 8k;
	# gzip_http_version 1.1;
	# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	##
	# Virtual Host Configs
	##

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;

    server {
        listen 80 default_server;
        listen 443 ssl default_server;
        listen [::]:80 default_server;
        listen [::]:443 ssl default_server;
        server_name paradise.fi.muni.cz anna.fi.muni.cz localhost 127.0.0.1;

        location / { alias /srv/www/web-paradise/; }

#        location ~ ^/~([^/]*)(.*)\.php$ {
#            fastcgi_pass unix:/run/php56-fpm/php-fpm-commonphp.sock;
#            fastcgi_index index.php;
#            fastcgi_param HTTPS $https;
#            fastcgi_param SCRIPT_FILENAME /home/$1/public_html/$2.php;
#            include /etc/nginx/fastcgi_params;
#        }

        location ~ ^/~([^/]*)(.*) {
#            index index.html index.php;
            autoindex on;
            alias /home/$1/public_html$2;
        }

        location = /~xbarnat/HLIDANI_PISEMEK/ {
#            return 302 https://paradise.fi.muni.cz/examwatch/xbarnat/;
        }

        location ~ /examwatch/([^/]*)/ {
            if ($scheme != https) {
                rewrite ^/(.*) https://paradise.fi.muni.cz/$1 redirect;
            }

            auth_pam "Hlídání písemek / Exam Watch";
            auth_pam_service_name "nginx";

#            fastcgi_param SCRIPT_FILENAME /srv/www/cgi/examwatch.pl;
            fastcgi_param NGINX_AUTH_USER $remote_user;
            fastcgi_param EXAMINER $1;
            fastcgi_pass  unix:/run/fcgiwrap.socket;
            include       fastcgi.conf;
        }

#        location ~ ^/yahoda/(.*)\.cgi$ {
#            fastcgi_pass antea.fi.muni.cz:9200; # unix:/tmp/cgi.sock;
##            fastcgi_pass  unix:/run/fcgiwrap.socket;
#            fastcgi_index index.cgi;
#            fastcgi_param HTTPS $https;
#            fastcgi_param SCRIPT_FILENAME /srv/www/yahoda/$1.cgi;
#            fastcgi_param REMOTE_USER $remote_user;

#            include /etc/nginx/fastcgi_params;
#        }

#        location /yahoda {
#            alias /srv/www/yahoda;
#        }

        location /papers {
            return 302 https://paradise.fi.muni.cz/publications.html;
        }

        location /PDMC {
            alias /srv/www/pdmc;
        }

        location /fmics2018 {
            rewrite ^/fmics2018/(.*) http://fmics2018.fi.muni.cz/$1 redirect;
        }

#        location ~ ^/hooks/(.*)\.cgi$ {
#            fastcgi_index index.cgi;
#            fastcgi_param SCRIPT_FILENAME /srv/www/hooks/$1.cgi;
#            fastcgi_pass  unix:/run/fcgiwrap.socket;
#            include       fastcgi.conf;
#        }

        location ~ ^/20([0-9][0-9])/(.*)$ {
            alias /srv/www/archive/20$1/$2;
            autoindex on;
        }

        location /hooks {
            alias /srv/www/hooks;
        }

        location /publications/ {
            return 302 https://paradise.fi.muni.cz/publications.html;
        }

        location /parameterSynthesis/ {
            alias /srv/www/parameterSynthesis/;
        }

        location /mirrors/archlinux/upstream/ {
            alias /archmirror/upstream/repo/;
            autoindex on;
        }

        location /mirrors/archlinux/next/ {
            alias /archmirror/next/repo/;
            autoindex on;
        }

        location /mirrors/archlinux/local/ {
            alias /archmirror/local/repo/;
            autoindex on;
        }

        location /authdata/ {
            alias /srv/www/web-paradise/authdata/;
            if ($scheme != https) {
                rewrite ^/(.*) https://paradise.fi.muni.cz/$1 redirect;
            }
            auth_pam "ParaDiSe local data";
            auth_pam_service_name "nginx";
        }
        location /auth/ {
            alias /srv/www/web-paradise-auth/;
            if ($scheme != https) {
                rewrite ^/(.*) https://paradise.fi.muni.cz/$1 redirect;
            }
            auth_pam "ParaDiSe local WIKI";
            auth_pam_service_name "nginx";

            location /auth/znc/ {
                if ($scheme != https) {
                    rewrite ^/(.*) https://paradise.fi.muni.cz/$1 redirect;
                }
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header Authorization "";
                proxy_pass http://127.0.0.1:7002/auth/znc/;
            }
            location /auth/irclogs/ {
                if ($scheme != https) {
                    rewrite ^/(.*) https://paradise.fi.muni.cz/$1 redirect;
                }
                location /auth/irclogs/serve.pl {
                    fastcgi_index index.cgi;
                    fastcgi_param SCRIPT_FILENAME /srv/pdsbot/pdsbot/serve.pl;
                    fastcgi_param NGINX_AUTH_USER $remote_user;
                    fastcgi_pass  unix:/run/fcgiwrap.socket;
                    include       fastcgi.conf;
                }
                alias /srv/pdsbot/logs/;
                try_files $uri /auth/irclogs/serve.pl;
                default_type text/plain;
                autoindex on;
            }
        }
    
    ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot

}

    server {
        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;
        server_name divine.fi.muni.cz;
        autoindex on;

        location / { alias /srv/www/divine/; }
        location /old { alias /srv/www/divine-old; }
        location /darcs {
            alias /home/xrockai/src/public/divine;
            autoindex on;
        }

        location ~ ^/20([0-9][0-9])/(.*)$ {
            alias /srv/www/archive/20$1/$2;
            autoindex on;
        }

        location /download/error.html {
            fastcgi_index index.cgi;
            fastcgi_param SCRIPT_FILENAME /srv/www/util/divine_download_error.pl;
            fastcgi_pass  unix:/run/fcgiwrap.socket;
            include       fastcgi.conf;
        }

        location /download/ {
            alias /srv/www/divine/download/;
            error_page 404 403 /download/error.html;
            index /download/error.html;
            autoindex off;

            rewrite ^/download.*/([^/]*\.html) /$1 redirect;
            rewrite ^/download.*/([^/]*\.css) /$1 redirect;
        }

        location /trac {
             proxy_pass http://127.0.0.1:3002/trac;
             proxy_set_header Host $host;
        }
    
    ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot
}

    server {
        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;
        # note that the duplicates here are so that certbot generates
        # certificate for both www and non-www versions, there is still no
        # wildcard cerificate, as that requires extra manual work or DNS plugin
        # for certbot
        server_name rofi.fi.muni.cz ro.fi.muni.cz rofibots.cz rofibots.com www.rofibots.cz www.rofibots.com *.rofibots.cz *.rofibots.com;
        root /srv/www/rofi/;
    
        ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
        ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot
    }

    server {
        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;
        server_name bioinformatika.fi.muni.cz;


        root /srv/www/sybila/;
#        rewrite ^/_media(.*) /data/media$1;
#        try_files $uri /doku.php?id=$uri&$args;

#        location ~ ^(.*)\.php$ {
#            fastcgi_pass unix:/run/php56-fpm/php-fpm-sybila.sock;
#            fastcgi_index index.php;
#            fastcgi_param HTTPS $https;
#            fastcgi_param SCRIPT_FILENAME /srv/www/sybila/$1.php;
#            include /etc/nginx/fastcgi_params;
#        }
    
    ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot
}

    server {
        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;
        server_name hsb2015.fi.muni.cz;
        root /srv/www/hsb2015/;
    
    ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot
}

    server {
        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;
        server_name sasb2016.fi.muni.cz;
        root /srv/www/sasb2016/;

    ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot
}

    server {
        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;
        server_name biodivine.fi.muni.cz;

        # note: while index only redirects outside, there are other pages
        # reachable by external links, e.g., http://biodivine.fi.muni.cz/aeon
        root /srv/www/biodivine/;

    
    ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot
}

    server {
        listen 80;
        listen 443 ssl;
        listen [::]:80;
        listen [::]:443 ssl;
        server_name fmics2018.fi.muni.cz;
        root /srv/www/fmics2018/;
    
    ssl_certificate /etc/letsencrypt/live/anna.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/anna.fi.muni.cz/privkey.pem; # managed by Certbot
}
}
