# Generated by Chef
#

<% ## -%>
<% ## Initial directives -%>
<% ## -%>
<% @init_statements.each do |ins| -%>
<%= ins %>
<% end -%>
<% ## -%>
<% ## List upstreams -%>
<% ## Example @upstreams element: -%>
<% ## { -%>
<% ##   :name => 'string', -%>
<% ##   :servers => [ -%>
<% ##     '127.0.0.1:9000', -%>
<% ##     '/var/run/php-fpm.sock' -%>
<% ##   ] -%>
<% ## } -%>
<% ## -%>
<% @upstreams.each do |us| -%>
<%   us_servers = us[:servers].inject([]) do |acc, serv| -%>
<%     acc << ( serv[0] == '/' ? "unix:#{serv}" : serv ) -%>
<%     acc -%>
<%   end -%>
upstream <%= us[:name] %> {
<%   us_servers.each do |serv| -%>
    server <%= serv %>;
<%   end -%>
}

<% end -%>
<% ## -%>
<% ## Server block for default nameless server -%>
<% ## -%>
<% if @catch_all -%>
server {
    listen      80 default_server;
    server_name _;
    return      444;
}

<% end -%>
<% ## -%>
<% ## Main server block -%>
<% ## -%>
<% servers = @aliases.inject([@server_name]) do |acc, elem| -%>
<%   acc << elem -%>
<% end -%>
<% servers.uniq! -%>
<% if @ssl -%>
<%   if @catch_all -%>
server {
    listen      443 default_server;
    server_name _;
    return      444;
}

<%   end -%>
server {
    listen 80;
    server_name <%= servers.join(' ') %>;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl;

    ssl_certificate <%= @path_crt %>;
    ssl_certificate_key <%= @path_key %>;
<%   unless @ssl[:self_signed] -%>
<%     if @ssl[:cipher_suite] == 'modern' -%>

    # Modern cipher suite:
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;
<%     else -%>

    # Medium compatibility cipher suite (compatible with IE7 WinXP):
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA;
<%     end -%>
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_session_cache shared:SSL:10m;
    ssl_dhparam <%= @path_dhparam %>;
<%   end -%>
<%   hage = @ssl[:hsts_max_age] || '15758000' -%>
<%   hsub = @ssl.has_key?(:hsts_subdomains) ? @ssl[:hsts_subdomains] : true -%>
<%   hsts = "max-age=#{hage};" -%>
<%   hsts << 'includeSubDomains;' if hsub -%>
    add_header Strict-Transport-Security "<%= hsts %>";
<% else -%>
server {
    listen 80;

<% end -%>
<% @add_headers.each do |header, value| -%>
    add_header <%= header %> <%= value %>;
<% end -%>

    # Add CSP headers here:
    # [https://www.owasp.org/index.php/Content_Security_Policy]
    # [http://www.html5rocks.com/en/tutorials/security/content-security-policy/]
    #
    #add_header Content-Security-Policy "default-src 'self'";
    #add_header X-Content-Security-Policy "default-src 'self'";

    server_name <%= servers.join(' ') %>;
<% if @doc_root -%>
    root <%= @doc_root %>;
<% end -%>
<% if @index -%>
    index <%= @index %>;
<% end -%>

<% if @auth -%>
    auth_basic "<%= @auth[:msg] %>";
    auth_basic_user_file <%= @path_pass %>;

<% end -%>
    access_log <%= @log_dir %>/<%= @server_name %>.access.log<% if @access_log_options %> <%= @access_log_options %><% end %>;
    error_log <%= @log_dir %>/<%= @server_name %>.error.log;

<% if @block_fav -%>
    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

<% end -%>
<% if @block_robots -%>
    location = /robots.txt {
        allow all;
<%   unless @log_robots -%>
        log_not_found off;
        access_log off;
<%   end -%>
    }

<% end -%>
    # Deny all attempts to access hidden files and folders
    location ~ (^|/)\. {
        deny all;
<% unless @log_hidden -%>
        log_not_found off;
        access_log off;
<% end -%>
    }

<% @server_statements_1.each do |s1| -%>
    <%= s1 %>
<% end -%>

<% @includes.each do |inc| -%>
    include <%= inc %>;
<% end -%>

<% @server_statements_2.each do |s2| -%>
    <%= s2 %>
<% end -%>
}