{% set MAININT = salt['pillar.get']('host:mainint') %}
{% set MAINIP = salt['grains.get']('ip_interfaces').get(MAININT)[0] %}

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
	worker_connections 1024;
}

http {
	log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
					  '$status $body_bytes_sent "$http_referer" '
					  '"$http_user_agent" "$http_x_forwarded_for"';

	access_log  /var/log/nginx/access.log  main;

	sendfile            on;
	tcp_nopush          on;
	tcp_nodelay         on;
	keepalive_timeout   65;
	types_hash_max_size 2048;

	include             /etc/nginx/mime.types;
	default_type        application/octet-stream;

	include /etc/nginx/conf.d/*.conf;

	server {
		  listen 80 default_server;
		  server_name _;
		  return 301 https://$host$request_uri;
	}

	server {
		listen       8090 ssl http2 default_server;
		server_name  _;
		root         /opt/socore/html;
		index        blank.html;

		ssl_certificate "/etc/pki/nginx/server.crt";
		ssl_certificate_key "/etc/pki/nginx/server.key";
		ssl_session_cache shared:SSL:1m;
		ssl_session_timeout  10m;
		ssl_ciphers HIGH:!aNULL:!MD5;
		ssl_prefer_server_ciphers on;

		location ~ ^/kolide.agent.Api/(RequestEnrollment|RequestConfig|RequestQueries|PublishLogs|PublishResults|CheckHealth)$ {
			grpc_pass  grpcs://{{ MAINIP }}:8080;
			grpc_set_header Host $host;
			grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_buffering off;
		}

	}


	server {
		listen       443 ssl http2 default_server;
		server_name  _;
		root         /opt/socore/html/packages;
		index        index.html;

		ssl_certificate "/etc/pki/nginx/server.crt";
		ssl_certificate_key "/etc/pki/nginx/server.key";
		ssl_session_cache shared:SSL:1m;
		ssl_session_timeout  10m;
		ssl_ciphers HIGH:!aNULL:!MD5;
		ssl_prefer_server_ciphers on;

		location /fleet/ {
			proxy_pass https://{{ MAINIP }}:8080;
			proxy_read_timeout    90;
			proxy_connect_timeout 90;
			proxy_set_header      Host $host;
			proxy_set_header      X-Real-IP $remote_addr;
			proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header      Proxy "";
			proxy_set_header      X-Forwarded-Proto $scheme;
		}

		#error_page 404 /404.html;
		#    location = /40x.html {
		#}

		error_page 500 502 503 504 /50x.html;
			location = /usr/share/nginx/html/50x.html {
		}
	}

}