user  nginx;
worker_processes  auto;

error_log  /logs/nginx_error;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
  server_names_hash_bucket_size 64;
  server_tokens off;
  include       include.conf;
  include       /etc/nginx/mime.types;
  default_type  application/octet-stream;

  # Proxy Cache storage - so we can cache the DoH response from the upstream
  proxy_cache_path /var/cache/nginx/doh_cache levels=1:2 keys_zone=doh_cache:10m;

  real_ip_header      proxy_protocol;
  real_ip_recursive   on;
  set_real_ip_from    10.10.0.10;

  server {
      listen 80 default_server;

      location / {
          return 301 https://$host$request_uri;
      }
      location ~\.well-known {
        access_log /logs/nginx_certbot_access;
        root /certs/;
        try_files $uri =404;
      }
  }

  server {
    listen 10.10.0.2:443 ssl http2 proxy_protocol;
    listen 10.10.1.2:443 ssl http2;

    ssl_certificate /certs/self_public;
    ssl_certificate_key /certs/self_private;

    location /tlgrm {
      access_log /logs/nginx_tlgrm_access;
      proxy_pass http://php;
    }
  }

#~

  server {
    server_name _;
    listen 10.10.0.2:443 ssl http2 proxy_protocol;
    listen 10.10.1.2:443 ssl http2;
#-ssl
    # ssl_certificate /certs/cert_public;
    # ssl_certificate_key /certs/cert_private;
#-ssl
    ssl_certificate /certs/self_public;
    ssl_certificate_key /certs/self_private;

    access_log /logs/nginx_domain_access;

    location / {
      root /app;
      index override.html login.html;
      try_files $uri $uri/ =404;
    }
    location /adguard/ {
      access_log /logs/nginx_adguard_access;
      proxy_pass http://ad:80/;
      proxy_redirect / /adguard/;
      proxy_cookie_path / /adguard/;
    }
    location /webapp {
      access_log /logs/nginx_webapp_access;
      alias /app;
      index index.html;
      try_files $uri $uri/ /pac?$query_string;
    }
    location /pac {
      access_log /logs/nginx_pac_access;
      proxy_set_header Host $http_host;
      proxy_pass http://php;
    }
    location /ws {
        proxy_pass http://xr:443;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_read_timeout 5d;
     }
    # The DoH server block
    location /dns-query {
      access_log /logs/nginx_doh_access;
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      proxy_set_header  Host $host;
      proxy_set_header  X-Real-IP $remote_addr;
      proxy_set_header  X-Forwarded-Proto https;
      proxy_set_header  X-Forwarded-For $remote_addr;
      proxy_set_header  X-Forwarded-Host $remote_addr;
      proxy_cache doh_cache;
      proxy_cache_key $scheme$proxy_host$uri$is_args$args$request_body;
      proxy_pass https://ad/dns-query;
    }
  }
}