# Obfuscator's temporary upload buffer on VM213. This is Nginx/WebDAV config,
# not the Managed Flask application or document-processing code.
# Install as /etc/nginx/sites-enabled/obfuscator-upload.conf.
# The sites-enabled wildcard is included from Nginx's http context, where map is valid.
# Keep this file in sync with the installed VM config.

# Browser CORS allowlist for the Obfuscator Managed Flask origin.
# CORS is a browser policy, not authentication for direct HTTP clients.
map $http_origin $obfuscator_upload_cors_origin {
    default "";
    ~^https://obfuscator\.pythonk8s\.services\.ngcloud\.ru$ $http_origin;
}

server {
    listen 80;
    server_name obfuscator-upload.sinefo.ru;

    # Keep the ACME HTTP-01 challenge available for certificate renewal.
    location /.well-known/acme-challenge/ {
        root /var/www/acme;
    }

    # Send all other HTTP traffic to TLS.
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name obfuscator-upload.sinefo.ru;

    ssl_certificate /etc/letsencrypt/live/obfuscator-upload.sinefo.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/obfuscator-upload.sinefo.ru/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    client_max_body_size 1024m;

    # Temporary WebDAV staging directory: browser PUT, Flask GET/pull, then DELETE.
    location /obfuscator-upload/ {
        alias /var/www/obfuscator-upload/;
        dav_methods PUT DELETE;
        create_full_put_path on;
        client_max_body_size 1024m;
        add_header Access-Control-Allow-Origin $obfuscator_upload_cors_origin always;
        add_header Access-Control-Allow-Methods "PUT, GET, OPTIONS, DELETE" always;
        add_header Access-Control-Allow-Headers "Content-Type" always;
        add_header Access-Control-Max-Age 86400 always;
        if ($request_method = OPTIONS) { return 204; }
    }

    # Do not serve paths outside the upload endpoint.
    location / {
        return 404;
    }
}
# End of Obfuscator's VM213 upload-buffer config.

# TTL cleanup (configure separately as a cron job on VM213; this file does not
# install or schedule the job):
# find /var/www/obfuscator-upload/ -type f -mmin +30 -delete