server {
    listen 80;
    listen [::]:80;
    server_name helloayanova.com www.helloayanova.com;
    location ^~ /.well-known/acme-challenge {
        root /usr/share/nginx/html;
        default_type text/plain;
        allow all;
    }
    location / {
        rewrite ^ https://$host$request_uri? permanent;
    }
}
#https://helloayanova.com
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name helloayanova.com;
    server_tokens off;
    ssl_certificate /etc/letsencrypt/live/helloayanova.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/helloayanova.com/privkey.pem;
    ssl_buffer_size 8k;
    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;
    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8;
    location ^~ /.well-known/acme-challenge {
        root /usr/share/nginx/html;
        default_type text/plain;
        allow all;
    }
    return 301 https://www.helloayanova.com$request_uri;
}
#https://www.helloayanova.com
#This is the "web" server for static files outside of AyaNova app server
server {
    server_name www.helloayanova.com;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_tokens off;
    ssl on;
    ssl_buffer_size 8k;
    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;
    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4;
    ssl_certificate /etc/letsencrypt/live/helloayanova.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/helloayanova.com/privkey.pem;
    location ^~ /.well-known/acme-challenge {
        root /usr/share/nginx/html;
        default_type text/plain;
        allow all;
    }


    location / {
        #security headers
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;
        #CSP
        add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com https://ajax.googleapis.com; img-src 'self'; style-src 'self' https://maxcdn.bootstrapcdn.com; font-src 'self' data: https://maxcdn.bootstrapcdn.com; form-action 'self'; upgrade-insecure-requests;" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   }


    root /usr/share/nginx/html;
    index index.html;
}

#https://v8.helloayanova.com, https://test.helloayanova.com   helloayanova
server {
    server_name test.helloayanova.com v8.helloayanova.com;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_tokens off;
    ssl on;
    ssl_buffer_size 8k;
    ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;
    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_prefer_server_ciphers on;
    ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
    ssl_ecdh_curve secp384r1;
    ssl_session_tickets off;
    # OCSP stapling
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4;
    ssl_certificate /etc/letsencrypt/live/helloayanova.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/helloayanova.com/privkey.pem;
    location ^~ /.well-known/acme-challenge {
        root /usr/share/nginx/html;
        default_type text/plain;
        allow all;
    }

    location / {
        #security headers
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
        add_header X-XSS-Protection "1; mode=block" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Frame-Options "DENY" always;

        #CSP
        #https://developers.google.com/web/fundamentals/security/csp/
        add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self' 'unsafe-inline' https://apis.google.com; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/; font-src 'self' https://fonts.googleapis.com/ https://fonts.gstatic.com; form-action 'self'; upgrade-insecure-requests;" always;
        add_header Referrer-Policy "strict-origin-when-cross-origin" always;

        #This is "ayanova" because it's the docker network and port
        proxy_pass http://ayanova:7575;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "";
        proxy_set_header Host $http_host;
        proxy_cache_bypass $http_upgrade;

	#These timeouts are only required for large trial data generation which should be re-coded to start the process and return immediately
	#AS of alpha-4 large data generation on D.O. takes 1'04'' so setting these to 3 minutes as a safe margin

	proxy_connect_timeout       180;
	proxy_send_timeout          180;
	proxy_read_timeout          180;
	send_timeout                180;


   }


}