upstream <%=fetch(:application)%> {
  server <%="#{fetch(:app_server_host)}:#{fetch(:app_server_port)}"%>;
}

<%- if fetch(:nginx_use_ssl) -%>
server {
  listen         80;
  server_name    <%=fetch(:nginx_server_names)%>;
  rewrite        ^ https://$server_name$request_uri? permanent;
}
<%- end -%>

server {
  <%- if fetch(:nginx_use_ssl) -%>
  listen 443;
  ssl                 on;
  ssl_certificate <%=fetch(:nginx_ssl_certificate)%>;
  ssl_certificate_key <%=fetch(:nginx_ssl_private_key)%>;
  ssl_session_cache shared:SSL:10m;
  ssl_session_timeout  5m;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:DHE-RSA-AES128-GCM-SHA256:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
  ssl_prefer_server_ciphers   on;
  ssl_dhparam /etc/ssl/private/dhparams.pem;
  <%- end -%>

  server_name <%=fetch(:nginx_server_names)%>;
  root <%=current_path%>/public;
  access_log <%=shared_path%>/log/nginx-access.log;
  error_log <%=shared_path%>/log/nginx-error.log;
  rewrite_log on;

  client_max_body_size 4G;
  keepalive_timeout 5;

  if (-f $document_root/public/maintenance.html) {
    rewrite ^(.*)$ /public/maintenance.html;
    break;
  }

  location ~ ^/(assets)/ {
    root <%=current_path%>/public;
    gzip_static on;
    expires max;
    add_header Cache-Control public;
    break;
  }

  location / {
    try_files $uri/index.html $uri.html $uri @<%=fetch(:application)%>;

    error_page 404              /404.html;
    error_page 422              /422.html;
    error_page 500 502 503 504  /500.html;
    error_page 403              /403.html;
    break;
  }

  location @<%=fetch(:application)%> {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host            $http_host;
    <%- if fetch(:nginx_use_ssl) -%>
    proxy_set_header                 X-Forwarded-Proto https;
    <%- end -%>
    proxy_headers_hash_bucket_size   1024;
    proxy_headers_hash_max_size      512;
    proxy_read_timeout               <%=fetch(:nginx_read_timeout)%>;
    proxy_redirect                   off;
    proxy_pass                       http://<%=fetch(:application)%>;
    include                          proxy_params;
    break;
  }
}