proxy_cache_path  /var/lib/nginx/cache levels=1:2 keys_zone=auth_cache:5m inactive=60m;

server {
    listen       80;
    listen       [::]:80;
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  {{ repos_domain }} {{repos_rsync_domain}};
    root         /srv/ftp;

    include snippets/letsencrypt.conf;

    ssl_certificate      /etc/letsencrypt/live/{{ repos_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ repos_domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ repos_domain }}/chain.pem;

    satisfy  any;

    access_log   /var/log/nginx/{{ repos_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ repos_domain }}/access.log.json json_reduced;

    location /lastupdate {
        allow all;
    }

    location / {
        auth_request /devel/mirrorauth/;

        autoindex  on;
    }

    location = /devel/mirrorauth/ {
        internal;

        # Do not pass the request body, only http authorisation header is required
        proxy_pass_request_body off;
        proxy_set_header        Content-Length "";

        # Proxy headers
        proxy_set_header        Host                    "archlinux.org";
        proxy_set_header        X-Sent-From             "{{ vault_archweb_x_sent_from_secret }}";

        # Cache responses from the auth proxy
        proxy_cache             auth_cache;
        proxy_cache_key         $scheme$proxy_host$uri$http_authorization;

        # Minimize the number of requests to archweb
        proxy_cache_lock        on;
        proxy_cache_use_stale   updating;

        # Authentication to archweb
        proxy_pass https://archlinux.org;
	proxy_ssl_verify on;
	proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
    }
}
