
user   www  www;

worker_processes 1 ;  # no need for more than this on technotes

worker_priority 15; # renice so shell etc are higher priority

error_log /tmp/nginx.log debug;

pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile               off ; # per calomel.org causes redundant cacheing under zfs so turn off

    client_body_timeout      2s; # maximum time between packets the client can pause when sending nginx any data
    client_header_timeout    2s; # maximum time the client has to send the entire header to nginx
    keepalive_timeout       28s; # timeout which a single keep-alive client connection will stay open
    send_timeout            10s; # maximum time between packets nginx is allowed to pause when sending the client data

    disable_symlinks         on; # disable symlinks to avoid malicious symlinks out of the document root 

    proxy_cache_path /pkgsrccache levels=1:2 keys_zone=pkgsrc_cache:10m max_size=1000g inactive=2160h 
                 use_temp_path=off;

    log_format rt_cache '$remote_addr - $upstream_cache_status [$time_local]  '
                    '"$request" $status $body_bytes_sent '
                    '"$http_referer" "$http_user_agent"';

    access_log   /var/log/nginx/access.log rt_cache;

    server {
        listen       80 default_server;
        listen       [::]:80 default_server;

        server_name  pkgsrc.seastrom.com pkgsrc4.seastrom.com pkgsrc6.seastrom.com pkgsrc.cluetrust.net pkgsrc4.cluetrust.net pkgsrc6.cluetrust.net localhost ;

        set $upstream_endpoint_pkgsrc http://pkgsrc.joyent.com/ ;


        location '/.well-known/acme-challenge' {
                proxy_pass http://ansible.seastrom.com/.well-known/acme-challenge;
                proxy_http_version 1.1;
                proxy_set_header Host $host;
        }

	location / {

		allow 192.41.214.0/24;
                allow 192.148.252.0/23;
                allow 208.72.84.0/22;
                allow 2610:178::/32;
		allow 173.72.144.75/32;
		allow 127.0.0.1;
		deny  all;

		resolver 192.148.252.11 192.148.252.12 ;
#		set $upstream_endpoint_pkgsrc http://pkgsrc.joyent.com/ ;

		proxy_cache pkgsrc_cache;
#		proxy_pass $upstream_endpoint_pkgsrc ;
		proxy_pass http://pkgsrc.joyent.com/ ;
		proxy_cache_revalidate on ;
		proxy_cache_valid 200 10m ;

		proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;

	}

    }

    server {
        listen       80 ;
        listen       [::]:80 ;

        server_name  images.seastrom.com images4.seastrom.com images6.seastrom.com images.cluetrust.net images4.cluetrust.net images6.cluetrust.net ;

        set $upstream_endpoint_images https://images.joyent.com/ ;

        location '/.well-known/acme-challenge' {
                proxy_pass http://ansible.seastrom.com/.well-known/acme-challenge;
                proxy_http_version 1.1;
                proxy_set_header Host $host;
        }

	location / {

		allow 192.41.214.0/24;
                allow 192.148.252.0/23;
                allow 208.72.84.0/22;
                allow 2610:178::/32;
		allow 173.72.144.75/32;
		allow 127.0.0.1;
		deny  all;

                resolver 192.148.252.11 192.148.252.12 ;

#		set $upstream_endpoint_images https://images.joyent.com/ ;

		proxy_cache pkgsrc_cache;
#		proxy_pass $upstream_endpoint_images ;
		proxy_pass https://images.joyent.com/ ;
		proxy_cache_revalidate on;
		proxy_cache_valid 200 10m ;
		proxy_ssl_verify off ;

		proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;

	}
    }


    server {
        listen       443 default_server ssl http2 ;
        listen [::]:443 default_server ssl http2 ;

        server_name  pkgsrc.seastrom.com pkgsrc4.seastrom.com pkgsrc6.seastrom.com pkgsrc.cluetrust.net pkgsrc4.cluetrust.net pkgsrc6.cluetrust.net localhost ;

        ssl_certificate         /etc/ssl/local/server.crt ;
        ssl_certificate_key     /etc/ssl/local/server.key ;

        ssl_dhparam		/etc/ssl/local/dhparam2048.pem ;

        ssl_session_cache shared:SSL:5m;
        ssl_session_timeout 10m;

        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
        ssl_prefer_server_ciphers on;

        ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

        ssl_stapling on;
        ssl_stapling_verify on;

        set $upstream_endpoint_images https://images.joyent.com/ ;

        location / {

                allow 192.41.214.0/24;
                allow 192.148.252.0/23;
                allow 208.72.84.0/22;
                allow 2610:178::/32;
                allow 173.72.144.75/32;
                allow 127.0.0.1;
                deny  all;

                resolver 192.148.252.11 192.148.252.12 ;

#               set $upstream_endpoint_images https://images.joyent.com/ ;

                proxy_cache pkgsrc_cache;
#               proxy_pass $upstream_endpoint_images ;
		proxy_pass https://pkgsrc.joyent.com/ ;
                proxy_cache_revalidate on;
                proxy_cache_valid 200 10m ;
                proxy_ssl_verify off ;

                proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;

        }


    }


    server {
        listen       443 ssl http2 ;
        listen [::]:443 ssl http2 ;

        server_name  images.seastrom.com images4.seastrom.com images6.seastrom.com images.cluetrust.net images4.cluetrust.net images6.cluetrust.net ;

        ssl_certificate         /etc/ssl/local/server.crt ;
        ssl_certificate_key     /etc/ssl/local/server.key ;

        ssl_dhparam		/etc/ssl/local/dhparam2048.pem ;

        ssl_session_cache shared:SSL:5m;
        ssl_session_timeout 10m;

        ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
        ssl_prefer_server_ciphers on;

        ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS;

        ssl_stapling on;
        ssl_stapling_verify on;

        set $upstream_endpoint_images https://images.joyent.com/ ;

        location / {

                allow 192.41.214.0/24;
                allow 192.148.252.0/23;
                allow 208.72.84.0/22;
                allow 2610:178::/32;
                allow 173.72.144.75/32;
                allow 127.0.0.1;
                deny  all;

                resolver 192.148.252.11 192.148.252.12 ;

#               set $upstream_endpoint_images https://images.joyent.com/ ;

                proxy_cache pkgsrc_cache;
#               proxy_pass $upstream_endpoint_images ;
                proxy_pass https://images.joyent.com/ ;
                proxy_cache_revalidate on;
                proxy_cache_valid 200 10m ;
                proxy_ssl_verify off ;

                proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;

        }


    }

}

