worker_processes 1;
daemon off;
user nobody;
events { worker_connections 1024; }

error_log stderr error;

http {
    types_hash_max_size 4096;

    include    /etc/nginx/mime.types;

    sendfile on;

    access_log /dev/stdout;

    # no auth
    server {

        server_name localhost;

        listen 80;
        listen [::]:80;

        root /tmp/shared/images;

        location / {
            autoindex on;
            autoindex_format json;
            rewrite ^/gcs-bucket/(.*)$ /$1 last;
        }
    }
    # auth
    server {

        server_name localhost;

        listen 81;
        listen [::]:81;

        root /tmp/shared/images;

        auth_basic "auth test";
        auth_basic_user_file /etc/nginx/htpasswd;

        location / {
            autoindex on;
            autoindex_format json;
        }
    }
    # no auth. rate limit
    server {

        server_name localhost;

        listen 82;
        listen [::]:82;

        root /tmp/shared/images;

        location / {
            autoindex on;
            autoindex_format json;
	        limit_rate 100k;
            rewrite ^/gcs-bucket/(.*)$ /$1 last;
        }
    }
    # tls
    server {

        server_name localhost;

        listen 443 ssl;
        listen [::]:443 ssl;

        ssl_certificate /tmp/shared/certs/tls.crt;

        ssl_certificate_key /tmp/shared/certs/tls.key;

        root /tmp/shared/images;

        location / {
            autoindex on;
            autoindex_format json;
            rewrite ^/gcs-bucket/(.*)$ /$1 last;
        }
    }

    # tls + basic auth
    server {

        server_name localhost;

        listen 444 ssl;
        listen [::]:444 ssl;

        ssl_certificate /tmp/shared/certs/tls.crt;

        ssl_certificate_key /tmp/shared/certs/tls.key;

        root /tmp/shared/images;

        auth_basic "auth test";
        auth_basic_user_file /etc/nginx/htpasswd;

        location / {
            autoindex on;
            autoindex_format json;
        }
    }

    # rate-limited proxy for registry host
    upstream registry-host {
        server cdi-docker-registry-host:443;
    }

    map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
        '' 'registry/2.0';
    }

    server {
        server_name localhost;

        listen 83 ssl;
        listen [::]:83 ssl;

        ssl_certificate /tmp/shared/certs/tls.crt;
        ssl_certificate_key /tmp/shared/certs/tls.key;

        # disable any limits to avoid HTTP 413 for large image uploads
        client_max_body_size 0;
        chunked_transfer_encoding on;

        proxy_temp_path "/tmp/nginx-proxy";

        location /v2/ {
            proxy_pass https://registry-host;

            ## If $docker_distribution_api_version is empty, the header is not added.
            ## See the map directive above where this variable is defined.
            add_header 'Docker-Distribution-Api-Version' $docker_distribution_api_version always;

            proxy_set_header Host              $host;
            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto "https";
            proxy_read_timeout                 900;

            limit_rate 1M;
        }
    }
}
