upstream sapl_server {

  server unix:/var/interlegis/sapl/run/gunicorn.sock fail_timeout=0;

}

# Se o cliente já manda X-Request-ID, reaproveita; senão, usa $request_id (nginx)
map $http_x_request_id $req_id {
    default $http_x_request_id;
    ""      $request_id;
}


server {

    listen   80;
    server_name sapl.prod;

    client_max_body_size 4G;

    location /api/ {
        add_header 'Access-Control-Allow-Origin' '*';
        add_header 'Access-Control-Allow-Credentials' 'true';
        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, HEAD, OPTIONS';
        add_header 'Access-Control-Allow-Headers' 'Access-Control-Allow-Origin,XMLHttpRequest,Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With';
        add_header 'Access-Control-Expose-Headers' 'Access-Control-Allow-Origin,XMLHttpRequest,Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With';

#      handle the browser's preflight steps
       if ($request_method = 'OPTIONS') {
             add_header 'Access-Control-Allow-Origin' '*';
             add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, HEAD, OPTIONS';
             add_header 'Access-Control-Allow-Headers' 'Authorization,Accept,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
             add_header 'Access-Control-Expose-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range';
             add_header 'Access-Control-Max-Age' 1728000;
             add_header 'Content-Type' 'text/plain; charset=utf-8';
             add_header 'Content-Length' 0;
             return 204;
        }

        proxy_set_header X-Request-ID $req_id;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://sapl_server;
    }

    location /static/ {
        alias  /var/interlegis/sapl/collected_static/;
    }

    # Arquivos que dependem de autorização vão ao Django (sapl.base.media),
    # que devolve X-Accel-Redirect para /media-interna/. Manter a lista em
    # sincronia com PROTEGIDO_RE e MODELOS_DE_SESSAO (teste em
    # sapl/base/tests/test_media.py). Os dois regex ficam no nível do server
    # e antes de location /media/: um regex aninhado em /media/ teria
    # precedência sobre este.
    location ~* ^/media/sapl/(private/|[^/]+/(documentoadministrativo|documentoacessorioadministrativo|proposicao|sessaoplenaria|orador|oradorexpediente|oradorordemdia|justificativaausencia)/) {
        proxy_set_header X-Request-ID $req_id;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://sapl_server;
    }

    # Demais arquivos são públicos e servidos direto do disco; conteúdo que o
    # navegador executaria como página é forçado a download.
    location ~* ^/media/.+\.(html?|xhtml|xht|shtml|svgz?|xml|xsl|xslt|rdf|js|mjs|mht|mhtml|rss|atom|mml|kml|xspf)$ {
        root /var/interlegis/sapl;
        types { }
        default_type application/octet-stream;
        add_header Content-Disposition attachment always;
        add_header X-Content-Type-Options nosniff always;
    }

    # Só os tipos abaixo saem com Content-Type próprio; o resto (inclusive
    # +xml que o mime.types global entregaria inline) vai como octet-stream.
    location /media/ {
        root /var/interlegis/sapl;
        types {
            application/pdf                                         pdf;
            image/jpeg                                              jpg jpeg jpe;
            image/png                                               png;
            image/gif                                               gif;
            image/webp                                              webp;
            image/bmp                                               bmp;
            image/tiff                                              tif tiff;
            image/x-icon                                            ico;
            text/plain                                              txt;
            text/csv                                                csv;
            audio/mpeg                                              mp3;
            audio/ogg                                               ogg;
            video/mp4                                               mp4;
            video/webm                                              webm;
            application/rtf                                         rtf;
            application/zip                                         zip;
            application/msword                                      doc;
            application/vnd.ms-excel                                xls;
            application/vnd.ms-powerpoint                           ppt;
            application/vnd.openxmlformats-officedocument.wordprocessingml.document   docx;
            application/vnd.openxmlformats-officedocument.spreadsheetml.sheet         xlsx;
            application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
            application/vnd.oasis.opendocument.text                 odt;
            application/vnd.oasis.opendocument.spreadsheet          ods;
            application/vnd.oasis.opendocument.presentation         odp;
        }
        default_type application/octet-stream;
        add_header X-Content-Type-Options nosniff always;
    }

    location /media-interna/ {
        internal;
        alias /var/interlegis/sapl/media/;
        add_header X-Content-Type-Options nosniff always;
    }

    location / {
        proxy_set_header X-Request-ID $req_id;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://sapl_server;
    }

    error_page 500 502 503 504 /500.html;
    location = /500.html {
        root /var/interlegis/sapl/sapl/static/;
    }
}