
map "$http_x_eva_token:$http_authorization:$cookie_access_token:$cookie_session_token:$cookie_nginx_auth_token:$uri" $has_auth {
	default "False";
	"~.*:.*:.+:.*:password123:.*" "True";  # Browser Access: $cookie_access_token and correct $cookie_nginx_auth_token
	"~.*:.*:.*:.+:password123:.*" "True";  # Browser Access: $cookie_session_token and correct $cookie_nginx_auth_token
	"~.+:.*:.*:.*:.*:/api/.*" "True";  # API access: API-Token and /api
	"~.*:Bearer .+:.*:.*:.*:/api/.*" "True";  # /api/*, Authorization: Bearer ...
}

map "$http_user_agent" $possibly_ms_office {
	default "False";
	"~*office" "True";
	"~*Office" "True";
}

map "$has_auth:$possibly_ms_office" $redirect_type {
	default 0;
	"False:False" "noauth";
	"False:True" "msoffice";
}

server {
	listen 80;
	server_name @@@eva_domain%%% default;
	listen	   443 ssl;
	access_log /var/log/nginx/access_@@@eva_domain%%%.log;
	error_log /var/log/nginx/error_@@@eva_domain%%%.log;
	ssl_certificate	 /etc/nginx/ssl/@@@eva_domain%%%.crt;
	ssl_certificate_key /etc/nginx/ssl/@@@eva_domain%%%.key;
	ssl_session_timeout  5m;
	ssl_prefer_server_ciphers on;
	ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
	ssl_dhparam /etc/nginx/dh4096.pem;
	ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SEED:!CAMELLIA:!IDEA:!PSK:!SRP:!SSLv2:!SSL3;
	# Чтобы у клиента не было проблем с открытием нестандартных https портов
	error_page 497 @httpsredirect;
	location @httpsredirect {
		# Помогает из ws в wss редиретком и должен почмочь с ajax и статикой
		add_header Access-Control-Allow-Origin *;
		return 302 https://$host:$server_port$request_uri;
	}
	if ($scheme = http ) { return 302 https://$host$request_uri; }

	location / {
		if ($redirect_type = "noauth") {
			rewrite ^ https://$host/auth/not_authorized?next_url=$scheme://$http_host$request_uri redirect;
		}
		if ($redirect_type = "msoffice") {
			return 200 'Nginx. MS Office blank page. Open this page in browser.';
		}
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		# Для поддержки WebSocket
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade_ws;
		proxy_pass http://127.0.0.1:8080;
	}

	location /rdisk/file {
		if ($has_auth = "FALSE") {
			rewrite ^ https://$host/auth/signin?next_url=$scheme://$http_host$request_uri redirect;
		}
		expires epoch;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade_ws;
		proxy_pass http://127.0.0.1:8080;
	}

	# Веб-формы открываются неавторизованными пользователями
	location ~ (/sso/.*|/drawio/.*|/js/webform/webform.js|/crm/forms/CmfForm:.*|/forms/CmfForm:.*html$|/pub/.*|/docs/.*|/share/.*|/styles.*.css$|/runtime-es2015.*.js$|/polyfills-es2015.*.js$|/ngsw-worker.js.*$|/main-es2015.*.js$|/favicon.ico$|/tinymce/.*|/app/assets/.*|/socket.io/.*|cmf-service-worker.js|/files/.*) {
		proxy_set_header X-Forwarded-User $http_authorization;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade_ws;
		proxy_pass http://127.0.0.1:8080;
	}

	location /webdav {
		# 302 редирект здесь приводит к ошибке, чтобы пользовательские программы
		# запрашивали логин-пароль - нужно посылать 401.
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		proxy_pass http://127.0.0.1:8081;
	}

	location /static {
		proxy_hide_header 'Cache-Control';
		add_header Cache-Control private,max-age=259200;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		# Для поддержки WebSocket
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade_ws;
		proxy_pass http://127.0.0.1:8080;
	}

	location /auth {
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		# Для поддержки WebSocket
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade_ws;
		proxy_pass http://127.0.0.1:8080;
	}

	location /servicedesk {
		if ($has_auth = "FALSE") {
			rewrite ^ https://$host/servicedesk/auth/signin?next_url=$scheme://$http_host$request_uri redirect;
		}
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		# Для поддержки WebSocket
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade_ws;
		proxy_pass http://127.0.0.1:8080;
	}

	location /servicedesk/auth {
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header HTTPS $scheme;
		if ($scheme = https ) { set $ssl on; }
		proxy_set_header X-Forwarded-HTTPS $ssl;
		proxy_set_header X-Forwarded-Port $server_port;
		# Для поддержки WebSocket
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade_ws;
		proxy_pass http://127.0.0.1:8080;
	}
}
