# Nginx configs for "jungle.horse" and "api.jungle.horse" (http)
#
# On Ubuntu Linux, this config is located at the following location:
# 
#  - /etc/nginx/sites-enabled/{name-of-site}
#
# Move this file there, and then restart with,
#
#   sudo service nginx restart
#
# On Mac, this is located at the following locations:
#
#  - /opt/homebrew/etc/nginx/servers/{name-of-site} (for nginx installed with homebrew)
#  - /usr/local/etc/nginx/sites-enabled/{name-of-site} (for default nginx install)
#
#
# On Mac, verify configs and restart with,
#
#   sudo nginx -t
#   sudo nginx -s reload
#
#           ================
#           SSL Instructions
#           ================
#
# To create self-signed certs on Ubuntu Linux,
#
#     sudo apt-get install openssl
#
#     sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/localhost.key -out /etc/ssl/certs/localhost.crt
#
#     ^ most fields can be blank, but the "Common Name" should be `*.jungle.horse`
#
# For more: https://www.cloudsavvyit.com/1306/how-to-create-and-use-self-signed-ssl-on-nginx/
#
# To create self-signed certs on Mac,
#
#     openssl req -x509 -sha256 -nodes -newkey rsa:2048 -days 365 -keyout localhost.key -out localhost.crt
#
#     ^ most fields can be blank, but the "Common Name" should be `*.jungle.horse`
#
# On Mac, load the self signed cert into the keychain with the following command:
#
#     sudo security add-trusted-cert \
#      -d -r trustRoot \
#      -k /Library/Keychains/System.keychain /etc/ssl/certs/localhost.crt
#
# Self signed certs might be considered insecure by the browser. In Firefox, 
# set about:config `security.tls.insecure_fallback_hosts` to include a list of
# permitted domains. You may also need to configure other settings. 
#
#

# API backend over plain HTTP
server {
    listen 80;
    server_name api.jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:12345;
        proxy_redirect off;
    }
}

# API backend over SSL
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    ssl_certificate /etc/ssl/certs/localhost.crt;
    ssl_certificate_key /etc/ssl/private/localhost.key;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    server_name api.jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:12345;
        proxy_redirect off;
    }
}

# TODO(2022-02-13): This is new and untested
# WebSocket API backend over plain HTTP
server {
    listen 80;
    server_name ws.jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:54321;
        proxy_redirect off;
    }
}

# Websocket API backend over SSL
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    ssl_certificate /etc/ssl/certs/localhost.crt;
    ssl_certificate_key /etc/ssl/private/localhost.key;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    server_name ws.jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:54321;
        proxy_redirect off;
    }
}

# Javascript frontend over plain HTTP
server {
    listen 80;
    server_name jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:7000;
        proxy_redirect off;
    }
}

# TODO(2022-02-13): This is new and untested
# Javascript frontend (OBS Layer) over plain HTTP
server {
    listen 80;
    server_name obs.jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:7007;
        proxy_redirect off;
    }
}

# Javascript frontend over SSL
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    ssl_certificate /etc/ssl/certs/localhost.crt;
    ssl_certificate_key /etc/ssl/private/localhost.key;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    server_name jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:7000;
        proxy_redirect off;
    }
}

# Javascript frontend over SSL (OBS Layer)
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    ssl_certificate /etc/ssl/certs/localhost.crt;
    ssl_certificate_key /etc/ssl/private/localhost.key;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    server_name obs.jungle.horse;
    location / {
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:7007;
        proxy_redirect off;
    }
}
