user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log warn;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    server {
        listen 80;
        # Ensure our redirects don't go to other ports, see https://serverfault.com/questions/351212/nginx-redirects-to-port-8080-when-accessing-url-without-slash
        port_in_redirect off;
        # Ensure our redirects are scheme-agnostic. Important behind a SSL-terminated load balancer.
        absolute_redirect off;

        root /web;

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        index index.php index.html index.htm;

        # Increase upload max body size
        client_max_body_size 5m;
        client_body_buffer_size 5m;

        # Restore IP from Proxy
        set_real_ip_from 127.0.0.0/8;
        set_real_ip_from 10.0.0.0/8;
        set_real_ip_from 172.16.0.0/12;
        set_real_ip_from 192.168.0.0/16;
        real_ip_header X-Real-IP;

        # We don't want to pass calls to css, script, and image files to the index,
        # whether they exist or not. So quit right here, and allow direct access
        # to common format files. Add formats here to allow direct link access
        location ~ \.(gif|png|jpe?g|bmp|css|js|swf|wav|avi|mpg|ttf|woff|ico)$ {
            # Show empty flag
            # location ~ (/web/hlstatsimg/images/flags)/.*\.(png|jpeg|jpg|gif)$ {
            #     try_files $uri $1/xx.png =404;
            # }

            access_log off;
            add_header Cache-Control "public, s-maxage=600, maxage=600";
            try_files $uri =404;
        }

        # Deny access to hidden files
        location ~ /\.[^/]+$ {
            return 401;
        }
        # Deny access to the certain files / folders
        location ~ ^/config.php {
            return 401;
        }
        location ~ ^/(includes|pages|updater|system)/ {
            return 401;
        }

        location ~ \.php$ {
            # Check that the PHP script exists before passing it
            try_files $fastcgi_script_name =404;

            # Disable fastcgi output buffering
            fastcgi_buffering off;

            # Set fastcgi max execution response time
            fastcgi_read_timeout 3600s;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_index index.php;
            fastcgi_pass 127.0.0.1:9000;
        }

        location / {
            limit_except GET POST {
                deny all;
            }

            # Pass everything else to php
            try_files $uri $uri/ =404;
        }
    }
}
