# DO NOT EDIT - This file is being maintained by Chef

user  www-data;
worker_processes auto;
worker_cpu_affinity auto;
worker_rlimit_nofile 98304;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  8192;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    server_names_hash_bucket_size 128;
    map_hash_bucket_size 128;

<% if node[:nginx][:access_log] -%>
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  <%= node[:nginx][:access_log] %>  main buffer=256k flush=1m;
<% else -%>
    access_log  off;
<% end -%>

    keepalive_timeout 20 20;

    server_tokens off;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_ciphers <%= node[:ssl][:openssl_ciphers] -%>;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 30m;

    ssl_stapling on;

    # Validate the stapling response is signed by a trusted certificate
    ssl_stapling_verify on;
    ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;

    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    resolver 127.0.0.53;
    resolver_timeout 5s;

    <% if node['nginx']['cache']['fastcgi']['enable'] -%>
    fastcgi_cache_path <%= node['nginx']['cache']['fastcgi']['directory'] %> levels=2:2:2 use_temp_path=off keys_zone=<%= node['nginx']['cache']['fastcgi']['keys_zone'] %> inactive=<%= node['nginx']['cache']['fastcgi']['inactive'] %> max_size=<%= node['nginx']['cache']['fastcgi']['max_size'] %>;
    <% end -%>
    <% if node['nginx']['cache']['proxy']['enable'] -%>
    proxy_cache_path <%= node['nginx']['cache']['proxy']['directory'] %> levels=2:2:2 use_temp_path=off keys_zone=<%= node['nginx']['cache']['proxy']['keys_zone'] %> inactive=<%= node['nginx']['cache']['proxy']['inactive'] %> max_size=<%= node['nginx']['cache']['proxy']['max_size'] %>;
    <% end -%>

    # Internal site for munin monitoring
    server {
      listen 127.0.0.1:8050;
      server_name localhost;
      location /nginx_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        deny all;
      }
    }

    include /etc/nginx/conf.d/*.conf;
}