{% for config in matrix_nginx_config %}
upstream matrix_{{ config.name }} {
    server 127.0.0.1:{{ config.port }};
}

{% endfor %}
server {
    listen       80;
    listen       [::]:80;
    server_name  {{ matrix_domain }};

    access_log   /var/log/nginx/{{ matrix_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ matrix_domain }}/access.log.json json_reduced;
    error_log    /var/log/nginx/{{ matrix_domain }}/error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  {{ matrix_domain }};

    access_log   /var/log/nginx/{{ matrix_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ matrix_domain }}/access.log.json json_reduced;
    error_log    /var/log/nginx/{{ matrix_domain }}/error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;

{% for config in matrix_nginx_config %}
    # {{ config.name }}
{% for location in config.locations %}
    location {{ location }} {
        access_log   /var/log/nginx/{{ matrix_domain }}/access.log main;
        access_log   /var/log/nginx/{{ matrix_domain }}/access.log.json json_main;
        proxy_pass http://matrix_{{ config.name }};
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
        proxy_read_timeout 900s;
        client_max_body_size {{ matrix_max_upload_size }};
    }
{% endfor %}

{% endfor %}
{% for ep in matrix_metrics_endpoints %}
    location = /metrics/{{ ep.name }} {
        if ($http_authorization != "Bearer {{ vault_matrix_secrets.metrics_token }}") {
            return 403;
        }
        proxy_pass http://127.0.0.1:{{ ep.port }}/{{ ep.path | default('') }};
    }

{% endfor %}
    location = /metrics {
        if ($http_authorization != "Bearer {{ vault_matrix_secrets.metrics_token }}") {
            return 403;
        }
        default_type text/plain;
        return 200 "Available endpoints:\n{% for ep in matrix_metrics_endpoints %}  /metrics/{{ ep.name }}\n{% endfor %}";
    }

    location = / {
        default_type text/plain;
        return 200 "Nothing to see here.";
    }

    location / {
        return 404;
    }
}
