upstream tuleap-apache {
  server 127.0.0.1:8080;
}

upstream tuleap-php-fpm {
  server 127.0.0.1:9000;
}

upstream tuleap-php-fpm-long-running-request {
  server 127.0.0.1:9002;
}

server {
	server_name  			alm.congineer.com;
	listen       			5.189.133.180:443 ssl;
    add_header 				Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
	# Tweak for file upload and SVN
	client_max_body_size 256M;
    # Tuleap provided configs
	include conf.d/tuleap.d/*.conf;

	# EXPLICIT CERTIFICATE PATHS NEEDED HERE BEACAUSE OF EXTERNAL TULEAP NGINX CONFIG
	ssl_stapling 			on; # Enable OCSP stapling.
    #_________________________________________________________________________
	ssl_certificate_key /home/congineer/ssl.key;
    	# LetsEncrypt Cert-bot certificates moved to _bkp folder
		#ssl_certificate_key /etc/letsencrypt_bkp/live/congineer.com/privkey.pem;
    # Certificates; server certificate first, followed by all
	# required intermediate certificates, but excluding the root.
	ssl_certificate /home/congineer/ssl.combined;
        # LetsEncrypt Cert-bot certificates moved to _bkp folder
		#ssl_certificate /etc/letsencrypt_bkp/live/congineer.com/fullchain.pem;
    #_________________________________________________________________________
    # OCSP response validation requires that the complete certificate chain is available. 
    # Provide here all intermediate certificates including the root, which is normally not
	# included when configuring server certificates.
    ssl_trusted_certificate /home/congineer/ssl.ca; # OCSP will work with fullchain.pem too
            # LetsEncrypt Cert-bot certificates moved to _bkp folder
            #ssl_trusted_certificate /etc/letsencrypt_bkp/live/congineer.com/chain.pem; 
    #_________________________________________________________________________
    
	#oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    # Catch the LetsEncrypt tiny client ACME-challanges
    # https://community.letsencrypt.org/t/how-to-nginx-configuration-to-enable-acme-challenge-support-on-all-http-virtual-hosts/5622
    # Rule for legitimate ACME Challenge requests (like /.well-known/acme-challenge/xxxxxxxxx)
	# We use ^~ here, so that we don't check other regexes (for speed-up). We actually MUST cancel
	# other regex checks, because in our other config files have regex rule that denies access to files with dotted names.
    location ^~ /.well-known/acme-challenge/ {
    # Check if the test.txt is accessible before requesting certificates:
    # https://alm.congineer.com/.well-known/acme-challenge/test.txt
        default_type 		"text/plain";
        root 				/home/congineer/public_html;
    }
	# Hide /acme-challenge subdirectory and return 404 on all requests.
	# It is somewhat more secure than letting Nginx return 403.
	# Ending slash is important!
	location = /.well-known/acme-challenge/ {
	    return 404;
	}
    ## AFTER LetsEncrypt ACME we can disable access to .htaccess and OTHER hidden files
    location ~ /\. {
        deny all;
        access_log off;
        log_not_found off;
    }
	#oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    rewrite_log 			off; # rewrite "last" = rewrite AND re-start search of appropriate server
    rewrite 				^/(host|HOST|Host|hcode02|hCODE02|HCODE02)$ https://hCODE02.congineer.com:10000 last;
    rewrite 				^/(admin|alm|cd|ADMIN|ALM|CD)$ https://$1.congineer.com last;
	rewrite 				^/(mail|email|eMail|Email|EMail|MAIL|EMAIL|e-mail|e-Mail|E-mail|E-Mail|E-MAIL)$ https://mail.congineer.com last;

	#ssl_certificate /etc/pki/tls/certs/localhost.crt;
	#ssl_certificate_key /etc/pki/tls/private/localhost.key
	#ssl_session_timeout 1d;
	#ssl_session_cache shared:SSL:50m;
	#ssl_session_tickets off;
	# intermediate configuration. tweak to your needs.
	#ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	#ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
	#ssl_prefer_server_ciphers on;

	# Available here in case of emergency, uncomment the
	# line below (and comment the line above)
    #include conf.d/tuleap-apache.proxy;
}
