{{ autogenerated }}
# see:
# https://gitlab.com/gitlab-org/gitlab-ce/blob/master/lib/support/nginx/gitlab-ssl
# https://gitlab.com/gitlab-org/omnibus-gitlab/blob/master/files/gitlab-cookbooks/gitlab/templates/default/nginx.conf.erb
# (last updated for omnibus-gitlab 8.8.9+ce.0-g25376053)

{% from 'macrolib.cfg.in' import cfg  with context %}

# user directive makes sense only when running initially as root
# (and nginx will complain if not and directive given)
# user {{ backend_info.user }};

worker_processes {{ cfg('nginx_worker_processes') }};
error_log stderr;
pid {{ directory.run }}/nginx.pid;

daemon off;

events {
  worker_connections {{ cfg('nginx_worker_connections') }};
}

http {
  log_format gitlab_access '{{ cfg("nginx_log_format") }}';
  {# we do not use: ci, mattermost
  log_format gitlab_ci_access '<%= @gitlab_ci_access_log_format %>';
  log_format gitlab_mattermost_access '<%= @gitlab_mattermost_access_log_format %>';
  #}

  sendfile    {{ cfg('nginx_sendfile') }};
  tcp_nopush  {{ cfg('nginx_tcp_nopush') }};
  tcp_nodelay {{ cfg('nginx_tcp_nodelay') }};

  keepalive_timeout {{ cfg('nginx_keepalive_timeout') }};

  gzip              {{ cfg('nginx_gzip') }};
  gzip_http_version {{ cfg('nginx_gzip_http_version') }};
  gzip_comp_level   {{ cfg('nginx_gzip_comp_level') }};
  gzip_proxied      {{ cfg('nginx_gzip_proxied') }};
  gzip_types        {{ cfg('nginx_gzip_types') }};

  include {{ nginx_mime_types }};

  {# we do not do nginx caching:
     - gitlab-workhorse serves raw blobs fast
     - we have caches on frontend nodes
  proxy_cache_path <%= @proxy_cache_path %>;
  proxy_cache <%= @proxy_cache %>;
  #}

  include {{ nginx_gitlab_http_conf }};

  map $http_upgrade $connection_upgrade {
      default upgrade;
      ''      close;
  }

  # Remove private_token from the request URI
  # In:  /foo?private_token=unfiltered&authenticity_token=unfiltered&rss_token=unfiltered&...
  # Out: /foo?private_token=[FILTERED]&authenticity_token=unfiltered&rss_token=unfiltered&...
  map $request_uri $temp_request_uri_1 {
    default $request_uri;
    ~(?i)^(?<start>.*)(?<temp>[\?&]private[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
  }

  # Remove authenticity_token from the request URI
  # In:  /foo?private_token=[FILTERED]&authenticity_token=unfiltered&rss_token=unfiltered&...
  # Out: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=unfiltered&...
  map $temp_request_uri_1 $temp_request_uri_2 {
    default $temp_request_uri_1;
    ~(?i)^(?<start>.*)(?<temp>[\?&]authenticity[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
  }

  # Remove rss_token from the request URI
  # In:  /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=unfiltered&...
  # Out: /foo?private_token=[FILTERED]&authenticity_token=[FILTERED]&rss_token=[FILTERED]&...
  map $temp_request_uri_2 $filtered_request_uri {
    default $temp_request_uri_2;
    ~(?i)^(?<start>.*)(?<temp>[\?&]rss[\-_]token)=[^&]*(?<rest>.*)$ "$start$temp=[FILTERED]$rest";
  }

  # A version of the referer without the query string
  map $http_referer $filtered_http_referer {
    default $http_referer;
    ~^(?<temp>.*)\? $temp;
  }


  {# we don't need: ci, pages, mattermost, registry
  include <%= @gitlab_ci_http_config %>
  include <%= @gitlab_pages_http_config %>;
  include <%= @gitlab_mattermost_http_config %>
  include <%= @gitlab_registry_http_config %>;
  #}

}
