# Dedicated WebDAV upload buffer for Contracts on VM213.
# Install as /etc/nginx/sites-enabled/contracts-upload.conf.

# sites-enabled is included from Nginx's http context, where map is valid.
map $http_origin $contracts_upload_cors_origin {
    default "";
    ~^https://contractor\.pythonk8s\.dev\.nubes\.ru$ $http_origin;
    ~^http://(localhost|127\.0\.0\.1):5001$ $http_origin;
}

server {
    listen 80;
    server_name contracts-upload.sinefo.ru;

    location /.well-known/acme-challenge/ {
        root /var/www/acme;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name contracts-upload.sinefo.ru;

    ssl_certificate /etc/letsencrypt/live/contracts-upload.sinefo.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/contracts-upload.sinefo.ru/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # Match the app's 50 MiB per-file limit; uploads are raw PUT bodies.
    client_max_body_size 50m;

    location /contracts-upload/ {
        alias /var/www/contracts-upload/;
        dav_methods PUT DELETE;
        create_full_put_path on;
        client_max_body_size 50m;
        add_header Access-Control-Allow-Origin $contracts_upload_cors_origin always;
        add_header Access-Control-Allow-Methods "PUT, GET, OPTIONS, DELETE" always;
        add_header Access-Control-Allow-Headers "Content-Type" always;
        add_header Access-Control-Max-Age 86400 always;
        if ($request_method = OPTIONS) { return 204; }
    }

    location / {
        return 404;
    }
}