server {
  listen ${NGINX_LISTEN};
  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
  ssl_certificate /etc/nginx/ssl/selfsigned.crt;
  ssl_certificate_key /etc/nginx/ssl/selfsigned.key;

  server_name localhost;
  root /twake-core/web;

  add_header Strict-Transport-Security "max-age=31536000";

  location /.well-known {
      alias /twake-react/build/.well-known/;

      gzip on;
      gzip_disable "msie6";

      add_header Cache-Control "no-store, public, max-age=0";
      add_header Cross-Origin-Opener-Policy 'same-origin-allow-popups; report-to="DurableDeepLinkUi"';
      add_header Cross-Origin-Resource-Policy "same-site";
      add_header Content-Type "application/json; charset=utf-8";
      add_header Last-Modified "";
      add_header Vary "Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site";
      add_header X-Content-Type-Options "nosniff";
      add_header X-Frame-Options "SAMEORIGIN";
      add_header X-XSS-Protection "0";

      proxy_buffering off;
      if_modified_since off;
      expires 0s;
      allow all;
   
      try_files $uri /index.html;
  }

  location / {
      gzip on;
      gzip_disable "msie6";

      gzip_comp_level 6;
      gzip_min_length 1100;
      gzip_buffers 16 8k;
      gzip_proxied any;
      gzip_types
          text/plain
          text/css
          text/js
          text/xml
          text/javascript
          application/javascript
          application/x-javascript
          application/json
          application/xml
          application/rss+xml
          image/svg+xml;
      alias /twake-react/build/;
      allow all;
      try_files $uri /index.html;
  }

  location ~ ^/(internal).* {
      proxy_set_header X-Forwarded-Host $host;
      proxy_pass ${NODE_HOST};
  }

  location ~ ^/(plugins).* {
      set $target http://plugins_container:8080;
      proxy_set_header X-Forwarded-Host $host;
      proxy_pass $target;
  }

  location ~ ^/(api|administration/v2/).* {
      proxy_set_header X-Forwarded-Host $host;
      proxy_pass ${NODE_HOST};
  }

  location ~ ^/socket/.* {
      proxy_pass ${NODE_HOST};
      # this magic is needed for WebSocket
      proxy_http_version  1.1;
      proxy_set_header    Upgrade $http_upgrade;
      proxy_set_header    Connection "upgrade";
      proxy_set_header    Host $http_host;
      proxy_set_header    X-Real-IP $remote_addr;
      proxy_connect_timeout 7d;
      proxy_send_timeout 7d;
      proxy_read_timeout 7d;
  }

  location ~ ^/(ajax|api|administration|upload|bundle|medias).* {
      # try to serve file directly, fallback to rewrite
      try_files $uri @rewriteapp;
  }

  location @rewriteapp {
      # rewrite all to app.php
      rewrite ^(.*)$ /app.php/$1 last;
  }

  location ~ ^/(app|app_dev|config|dev\/.*)\.php(/|$) {
      fastcgi_pass php-upstream;
      fastcgi_split_path_info ^(.+\.php)(/.*)$;
      include fastcgi_params;
      fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
      fastcgi_param HTTPS off;
      fastcgi_buffer_size 128k;
      fastcgi_buffers 4 256k;
      fastcgi_busy_buffers_size 256k;
  }

}