nginx_ceamdev.conf

#################################################
# Nginx conf with qed + cyanweb + cyano,        #
# where cyano runs outside qed's docker network #
#################################################

map $http_origin $allowed_origins {
  "~^https://mywaterway\.epa\.gov$" "https://mywaterway.epa.gov";
  "~^https://mywaterway-dev\.app\.cloud\.gov$" "https://mywaterway-dev.app.cloud.gov";
  "~^https://mywaterway-stage\.app\.cloud\.gov$" "https://mywaterway-stage.app.cloud.gov";
  "~^https://mywaterway-attains\.app\.cloud\.gov$" "https://mywaterway-attains.app.cloud.gov";
  "~^https://ceamdev\.ceeopdev\.net$" "https://ceamdev.ceeopdev.net";
  # "~^http://localhost:4200$" "http://localhost:4200";
  default "";
}

# HTTP -> HTTPS Redirect
server {
    listen 80;
    server_name ceamdev.net;

    # Removes Nginx version from headers:
    server_tokens off;

    return 301 https://$host$request_uri;
}

# qed.epa.gov django front-end HTTPS/SSL
server {

    listen 443 ssl default_server;

    server_name ceamdev.net;

    client_max_body_size 20M;
    client_body_buffer_size 20M;

    # Allow CORS requests for development purposes, not to be copied to Staging or Production instances.
    # add_header Access-Control-Allow-Origin '*';
    add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS, DELETE';

    # HSTS Policy (max-age=60 == 1 min. 31536000 = 1 year)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Frame-Options "SAMEORIGIN";
    add_header X-Content-Type-Options nosniff;
    # add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src *; style-src *";

    add_header Access-Control-Expose-Headers "Content-Disposition";

    # add_header 'Access-Control-Allow-Origin' "$allowed_origins";
    add_header 'Access-Control-Allow-Origin' "*";

    add_header Access-Control-Allow-Headers "Authorization,Content-Type,App-Name";

    # Self-signed cert and key (container locations):
    ssl_certificate /etc/letsencrypt/live/ceeopdev.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ceeopdev.net/privkey.pem;

    ssl_session_timeout  5m;

    #disable ssl2 and ssl3 per
    #https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # Diffie-Hellman file:
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # Removes Nginx version from headers:
    server_tokens off;

    location /static_qed/ {
        alias /src/collected_static/;
    }
    location /assets/ {
        alias /src/collected_static/hms/webapp/assets/;
    }
    location /hms/assets/ {
        alias /src/collected_static/hms/webapp/assets/;
    }

    location / {
        try_files $uri @uwsgi_django;
    }

    location @uwsgi_django {
        include uwsgi_params;
        uwsgi_pass uwsgi_django:8080;  # 'uwsgi_django' is the hostname given in Docker-Compose YAML 'links' section
        uwsgi_connect_timeout 180;
        proxy_read_timeout 600;
        proxy_send_timeout 600;
        uwsgi_read_timeout 600s; 
        uwsgi_send_timeout 600s;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # HSTS Policy (max-age=60 == 1 min), 31536000 = 1 year Unknown if proxy_set_header disables inheritance like add_header
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    }

    # nodejs/socket.io route:
    location /socket.io {
        proxy_pass          http://cts_nodejs:4000;
        proxy_http_version  1.1;
        proxy_set_header    Upgrade $http_upgrade;
        proxy_set_header    Connection 'upgrade';
        proxy_set_header    Host $host;
    }

    # # Proxy for ctsws endpoint:
    # location /ctsws/rest/isvalidchemical {
    #     proxy_pass http://ctsws:8080/ctsws/rest/isvalidchemical;
    # }

    # Cyanweb prevents env.json caching:
    location /cyanweb/assets/env.json {
        expires -1;
        add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
        alias /usr/share/nginx/html/cyanweb/assets/env.json;
    }

    # Cyanweb Frontend
    location /cyanweb {
        alias /usr/share/nginx/html/cyanweb;
        try_files $uri $uri/ /cyanweb/index.html;
    }

    # Cyanweb API:
    location /cyan/app/api {
        include /etc/nginx/uwsgi_params;
        uwsgi_pass uwsgi_flask:5001;
    }

    # Cyano Admintool
    location /admintool {
        proxy_pass http://172.17.0.1:8000;
    }

    # Cyano Admintool Static
    location /static {
        proxy_pass http://172.17.0.1:8000/static;
    }

    # Cyano Admintool Media
    location /media {
        proxy_pass http://172.17.0.1:8000/media;   
    }

    # Cyano API
    location /cyan/cyano {
        proxy_pass http://172.17.0.1:8080/cyan/cyano;
    }

    # Cyan-waterbody API (uwsgi)
    location /waterbody {
        try_files $uri @wb_flask;
    }
    location @wb_flask {
        include uwsgi_params;
        uwsgi_pass 172.17.0.1:8085;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # add_header Access-Control-Expose-Headers "Content-Disposition";
    }

    # Cyano API (qedlinux1api)
    location /qedlinux1api/cyan/cyano {
        proxy_pass https://cyan.epa.gov/cyan/cyano;
    }

    # Cyan-waterbody API (qedlinux1api)
    location /qedlinux1api/waterbody {
        proxy_pass https://cyan.epa.gov/waterbody;
    }

    # Cyano API (qedlinuxapi, new backend)
    location /qedlinuxapi/cyan/cyano {
        proxy_pass https://qedlinuxapi.epa.gov/cyan/cyano;
    }

    # Cyan-waterbody API (qedlinuxapi, new backend)
    location /qedlinuxapi/waterbody {
        proxy_pass https://qedlinuxapi.epa.gov/waterbody;
    }

    # # Proxy for marvinsketch iframe webservice requests:
    # location /webservices/rest-v0/util {
    #     proxy_pass  http://qed-tomcat:8080/webservices/rest-v0/util;
    # }

    # Proxy for jchemws endpoints:
    location /jchemws/webservices/rest-v0/util {
        proxy_pass http://jchemws:8080/webservices/rest-v0/util;
    }

    # Proxy for ctsws endpoints:
    location /ctsws/rest {
        proxy_pass http://ctsws:8080/ctsws/rest;
    }

    # # Proxy for ctsws endpoint:
    # location /ctsws/rest/isvalidchemical {
    #     proxy_pass http://ctsws:8080/ctsws/rest/isvalidchemical;
    # }

    # EPI Suite Proxy to GDIT Windows Dev box
    location /epi {
        proxy_pass http://172.31.29.163/episuite/rest/episuite;  # /estimated and /measured
    }

    location /biotransformer {
        proxy_pass http://172.17.0.1:5002/bt/rest/run;
    }

    # OPEARWS on GDIT Windows Dev box
    location /operaws/opera/rest/run {
        proxy_pass http://172.31.29.163:8080/opera/rest/run;
    }

    location /envipath {
        proxy_pass http://172.17.0.1:5003/envipath/rest/run;
    }

    # HMS Webapp
    location /hms/webapp {
        alias /usr/share/nginx/html/hms/webapp;
        try_files $uri $uri/ /hms/webapp/index.html;
    }

}

# Flask back-end
server {

    listen 7777;

    # HSTS Policy (max-age=60 == 1 min, 31536000 = 1 year)
    # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    client_max_body_size 20M;
    client_body_buffer_size 20M;

    location / {
        try_files $uri @qed_flask;
    }

    location @qed_flask {
        include uwsgi_params;
        uwsgi_pass qed_flask:8080;  # 'uwsgi_flask' is the hostname given in Docker-Compose YAML 'links' section
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # HSTS Policy (max-age=60 == 1 min 31536000 = 1 year), Unknown if proxy_set_header disables inheritance like add_header
        # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    }
}