nginx-common.conf

# use 'listen 80 deferred;' for Linux
# use 'listen 80 accept_filter=httpready;' for FreeBSD
listen {{port}};
client_max_body_size 250M;

keepalive_timeout 5;

# path for static files
root ./public;

# simplify redirect with relative path
absolute_redirect off;

# redirect /en/ locales to english
location ~ ^/en/(.*) {
  return  301 /$1;
}

location /api/action/status_show {
  auth_basic off;
  # health check need a redirect to resolve
  proxy_redirect off;
  set $backend_servers $internal_url:61443;
  proxy_pass https://${backend_servers}${request_uri};
}

location / {
  # Protect catalog from expensive API calls
  rewrite ^/api/rest/dataset$ /api/action/package_search redirect;
  rewrite ^/api/1/rest/dataset$ /api/3/action/package_search redirect;
  rewrite ^/api/2/rest/dataset$ /api/3/action/package_search redirect;

  rewrite ^/api/action/package_list$ /api/action/package_search redirect;
  rewrite ^/api/3/action/package_list$ /api/3/action/package_search redirect;

  rewrite ^/api/action/current_package_list_with_resources$ /api/action/package_search redirect;
  rewrite ^/api/3/action/current_package_list_with_resources$ /api/3/action/package_search redirect;

  rewrite ^/api/3/action/resource_search$ /api/action/package_search redirect;
  rewrite ^/api/action/resource_search$ /api/action/package_search redirect;

  # checks for static file, if not found proxy to app
  try_files $uri @proxy_to_app;
}

location @proxy_to_app {
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  # proxy_set_header Host $http_host;
  # we don't want nginx trying to do something clever with
  # redirects, we set the Host: header above already.
  proxy_redirect off;
  set $backend_servers $internal_url:61443;
  proxy_pass https://${backend_servers}${request_uri};
}

location = /robots.txt {
  root ./public;
}

# for google search console registration
location = /googlef06939d03de4c107.html {
  root ./public;
}

location = /sitemap.xml {
  # these values should be replaced by .profile
  set $s3_url s3_url_placeholder;
  set $s3_bucket s3_bucket_placeholder;
  proxy_pass https://${s3_url}/${s3_bucket}/sitemap.xml;
}

location /sitemap {
  set $s3_url s3_url_placeholder;
  set $s3_bucket s3_bucket_placeholder;
  proxy_pass https://${s3_url}/${s3_bucket}$request_uri;
}

error_page 500 502 503 504 /500.html;
location = /500.html {
  root ./public;
}

# prevent users from accessing: '/dataset/new' route, 'package_create' and 'resource_create' API routes
location ~ ^/(dataset\/new|api\/action\/package_create|api\/action\/resource_create)\/? {
  deny all;
}