user nginx;
worker_processes  1;

load_module /usr/lib/nginx/modules/ngx_http_auth_pam_module.so;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    # set plaintext data to UTF-8
    charset utf-8;
    charset_types text/html text/xml text/plain text/vnd.wap.wml application/javascript application/rss+xml;

    # ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!ADH:!AECDH:!MD5";
    ssl_ciphers HIGH:!CBC:!aNULL:!MD5;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 180m;
    ssl_dhparam /etc/nginx/ssl-dhparam.pem;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
    add_header X-Frame-Options DENY;
    add_header X-Content-Type-Options nosniff;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;
    # resolver 8.8.8.8 8.8.4.4 valid=300s; # Google DNS Servers
    # resolver_timeout 5s;
    resolver 147.251.48.3;
    ssl_certificate /etc/nginx/ssl-hesperia-chain.pem;
    ssl_certificate_key /etc/secret/hesperia.fi.muni.cz.key;

    upstream exprtest {
        server unix:/run/www/exprtest.sock;
        server 127.0.0.1:8080 backup;
    }

    server {
        listen       80 default_server;
        listen       443 ssl default_server;
        server_name  hesperia hesperia.fi.muni.cz;

        proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504 non_idempotent;

        location / {
            alias /srv/www/public/;
            index index.html index.cgi;

            location ~ ^/(.*).cgi$ {
                root          /srv/www/public;
                fastcgi_index index.cgi;
                fastcgi_pass  unix:/run/fcgiwrap.socket;
                fastcgi_param SCRIPT_FILENAME /srv/www/public/$1.cgi;
                include       /etc/nginx/fastcgi_params;
            }
        }

        location /is {
            allow 127.0.0.1; # allow localhost
            allow 147.251.49.0/24; # allow is
            deny all; # deny everyone else
            proxy_pass http://exprtest/is;
        }

        location /internal {
            allow 127.0.0.1; # allow localhost
            deny all; # deny everyone else
            proxy_pass http://exprtest/internal;
        }

        location /hint {
            proxy_pass http://exprtest/hint;
        }

        location /admin/ {
            if ($scheme != https) {
                rewrite ^/(.*) https://hesperia.fi.muni.cz/$1 redirect;
            }
            auth_pam "Hepseria admin: use FI login & password";
            auth_pam_service_name "nginx_logs";
            rewrite /admin/(.*) /admin/$remote_user/$1 break;
            proxy_pass http://exprtest;
            proxy_set_header X-Auth-User $remote_user;
            proxy_set_header X-Real-IP $remote_addr;
        }

        location /update-qdir {
            root          /usr/lib/cgi-bin;
            fastcgi_pass  unix:/run/fcgiwrap.socket;
            fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/update-qdir.sh;
            include       /etc/nginx/fastcgi_params;
        }

        location /los/2018/jednoducha {
            if ($scheme != https) {
                rewrite ^/(.*) https://hesperia.fi.muni.cz/$1 redirect;
            }
            auth_basic "Zadejte udaje ze zadani";
            auth_basic_user_file /var/lib/checker/qdir/interlos2018/data-orig/P1-jednoducha/htpasswd;
            alias /var/lib/checker/qdir/interlos2018/data-orig/P1-jednoducha;
            index index.html;
            location /los/2018/jednoducha/submit {
                root           /usr/lib/cgi-bin; ##
                fastcgi_pass   unix:/run/fcgiwrap.socket;
                fastcgi_param SCRIPT_FILENAME /usr/lib/cgi-bin/test-is.pl;
                include /etc/nginx/fastcgi_params;
            }
        }

        location /collector {
            if ($scheme != https) {
                rewrite ^/(.*) https://hesperia.fi.muni.cz/$1 redirect;
            }
            location /collector/pv264 {
                include uwsgi_params;
                uwsgi_pass unix:/run/uwsgi/collector/pv264.socket;
            }
        }

        location ~ /logs/([^/]*)/_handler {
            if ($scheme != https) {
                rewrite ^/(.*) https://hesperia.fi.muni.cz/$1 redirect;
            }
            include uwsgi_params;
            uwsgi_param  AUTH_USER        $remote_user;
            uwsgi_param LOG_COURSE        $1;
            uwsgi_pass unix:/run/uwsgi/logs/$1.socket;

            auth_pam "$1 logs: use FI login & password";
            auth_pam_service_name "nginx_logs";
        }

        location ~ /logs/([^/]*)/ {
            if ($scheme != https) {
                rewrite ^/(.*) https://hesperia.fi.muni.cz/$1 redirect;
            }
            alias /home/$1/logs/$remote_user/;
            auth_pam "$1 logs: use FI login & password";
            auth_pam_service_name "nginx_logs";
            default_type text/pain;

            autoindex off;
            error_page 404 403 /logs/$1/_handler;
            index /logs/$1/_handler;
        }

        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        # error_page   500 502 503 504  /50x.html;
        # location = /50x.html {
        #     root   /usr/share/nginx/html;
        # }

        location /support {
            alias /home/checker/hsExprTest/src/support;
        }

        location /auth {
            alias /srv/www/auth/;
            index index.html index.cgi;
            if ($scheme != https) {
                rewrite ^/(.*) https://hesperia.fi.muni.cz/$1 redirect;
            }
            auth_pam "Checker authorized section (FI login)";
            auth_pam_service_name "nginx";

            location ~ ^/auth/(.*).cgi$ {
                root          /srv/www/auth;
                fastcgi_index index.cgi;
                fastcgi_pass  unix:/run/fcgiwrap.socket;
                fastcgi_param SCRIPT_FILENAME /srv/www/auth/$1.cgi;
                fastcgi_param AUTH_USER_NAME $remote_user;
                include       /etc/nginx/fastcgi_params;
            }
        }

        location /los/2017/miby {
            if ($scheme != https) {
                rewrite ^/(.*) https://hesperia.fi.muni.cz/$1 redirect;
            }
            proxy_pass http://127.0.0.1:3001/;
            proxy_set_header   Host $host;
        }
    ssl_certificate /etc/letsencrypt/live/fja.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/fja.fi.muni.cz/privkey.pem; # managed by Certbot

}

    server {
        listen       80;
        listen       443 ssl;
        server_name  fja fja.fi.muni.cz;

        if ($scheme != https) {
            rewrite ^/(.*) https://fja.fi.muni.cz/$1 redirect;
        }

        location / { try_files $uri @main; }
        location @main {
            include uwsgi_params;
            uwsgi_pass unix:/run/uwsgi/fjaweb.socket;
        }
    ssl_certificate /etc/letsencrypt/live/fja.fi.muni.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/fja.fi.muni.cz/privkey.pem; # managed by Certbot

}
}
