# /etc/nginx/conf.d/sonarqube.conf

upstream sonarqube { server 127.0.0.1:9000; }
upstream guassp {
  server 127.0.0.1:8000 max_fails=1 fail_timeout=20s;
  server 127.0.0.1:8001 max_fails=1 fail_timeout=20s;
}

server {
  listen        80;
  server_name   sonarqube.tld;
  server_tokens off;

  set_real_ip_from  10.0.0.0/16;
  real_ip_header    X-Forwarded-For;
  real_ip_recursive on;

  rewrite ^ https://$host$request_uri? permanent;
}

server {
  listen        443 ssl http2;
  server_name   sonarqube.tld;
  server_tokens off;

  set_real_ip_from  10.0.0.0/16;
  real_ip_header    X-Forwarded-For;
  real_ip_recursive on;

  ssl_dhparam         /etc/nginx/ssl/dhparams.pem;
  ssl_certificate     /etc/nginx/ssl/sonarqube.tld.pem;
  ssl_certificate_key /etc/nginx/ssl/sonarqube.tld.key;

  ssl_protocols TLSv1.3 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA512:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:ECDH+AESGCM:ECDH+AES256:DH+AESGCM:DH+AES256:RSA+AESGCM:!aNULL:!eNULL:!LOW:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!AES128;

  ssl_session_cache shared:TLS:2m;
  ssl_buffer_size 4k;

  ssl_stapling on;
  ssl_stapling_verify on;

  add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload' always;

  access_log  /var/log/nginx/access-sonarqube.log  timed buffer=16k;
  error_log   /var/log/nginx/error-sonarqube.log   warn;

  chunked_transfer_encoding  on;

  location / {
    proxy_pass http://sonarqube/;

    proxy_set_header Host                   $host;
    proxy_set_header X-Real-IP              $remote_addr;
    proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host       $host;
    proxy_set_header X-Forwarded-Server     $host;
    proxy_set_header X-Forwarded-Port       $server_port;
    proxy_set_header X-Forwarded-Proto      $scheme;

    proxy_intercept_errors   on;
    proxy_redirect           off;
    proxy_buffering          off;
    proxy_request_buffering  off;
  }

  location /api/editions/is_valid_license {
    access_log off;
    default_type application/json;
    return 200 '{"isValidLicense": true}';
  }

  location /api/guassp {
    proxy_pass http://guassp/;

    proxy_set_header Host                   $host;
    proxy_set_header X-Real-IP              $remote_addr;
    proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host       $host;
    proxy_set_header X-Forwarded-Server     $host;
    proxy_set_header X-Forwarded-Port       $server_port;
    proxy_set_header X-Forwarded-Proto      $scheme;

    proxy_intercept_errors   off;
    proxy_redirect           off;
    proxy_buffering          off;
    proxy_request_buffering  off;
  }
}