worker_processes auto;
pid /tmp/nginx.pid;
error_log /dev/stderr notice;

events {
    worker_connections 256;
}

http {
  include /etc/nginx/mime.types;
  access_log /dev/stdout combined;
  client_body_temp_path /tmp/client_body;
  proxy_temp_path /tmp/proxy;
  fastcgi_temp_path /tmp/fastcgi;
  uwsgi_temp_path /tmp/uwsgi;
  scgi_temp_path /tmp/scgi;

  server {
      listen 8080;
      server_name _;
      server_tokens off;
      root /srv/image;
      disable_symlinks on;

    allow 127.0.0.1;
    allow ::1;
    include /tmp/trusted-proxy-allow.conf;
    deny all;

    location = /healthz {
        proxy_pass http://image-hook:8081/healthz;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location = /v1/status {
        proxy_pass http://image-hook:8081/v1/status;
        proxy_set_header Host $host;
        add_header Access-Control-Allow-Origin "*" always;
    }

    location = /v1/inventory {
        proxy_pass http://image-hook:8081/v1/inventory;
        proxy_set_header Host $host;
        proxy_buffering off;
        add_header Access-Control-Allow-Origin "*" always;
    }

    location = /v1/hooks/gitea {
        limit_except POST { deny all; }
        client_max_body_size 1m;
        proxy_pass http://image-hook:8081/v1/hooks/gitea;
        proxy_set_header Host $host;
        proxy_set_header X-Gitea-Signature $http_x_gitea_signature;
        proxy_set_header X-Gitea-Event $http_x_gitea_event;
        proxy_set_header X-Gitea-Delivery $http_x_gitea_delivery;
        proxy_request_buffering on;
    }

    location = /v1/sync {
        limit_except POST { deny all; }
        client_max_body_size 4k;
        proxy_pass http://image-hook:8081/v1/sync;
        proxy_set_header Host $host;
        proxy_set_header X-Image-Client $http_x_image_client;
        proxy_set_header X-Image-Timestamp $http_x_image_timestamp;
        proxy_set_header X-Image-Request-Id $http_x_image_request_id;
        proxy_set_header X-Image-Signature $http_x_image_signature;
        proxy_request_buffering on;
    }

    location ^~ /v1/admin/ { return 404; }
    location = /image { return 404; }
    location = /image/ { return 404; }
    location ^~ /image/ { rewrite ^/image/(.*)$ /$1 last; }

    location ^~ /game/ {
        try_files $uri =404;
        add_header Access-Control-Allow-Origin "*" always;
        add_header X-Content-Type-Options nosniff always;
    }

    location ^~ /icons/ {
        try_files $uri =404;
        add_header Access-Control-Allow-Origin "*" always;
        add_header X-Content-Type-Options nosniff always;
    }

    location = /hook/list.json {
        try_files $uri =404;
        add_header Access-Control-Allow-Origin "*" always;
    }

    location = /hook/inventory.v2.json {
        try_files $uri =404;
        add_header Access-Control-Allow-Origin "*" always;
    }

    location ~ (^|/)\. { return 404; }
    location ~ \.php$ { return 404; }
      location / { return 404; }
  }
}