server {
	listen 80;
	listen [::]:80;
	server_name git.leafos.org;
	return 301 https://$server_name$request_uri;
        root /var/www/git.leafos.org/;

	access_log /var/log/nginx/access/git.leafos.org.log;
	error_log /var/log/nginx/error/git.leafos.org.log;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;

	include hsts.conf;

	root /var/www/git.leafos.org/;

	# Add index.php to the list if you are using PHP
	index index.html index.htm index.php;

	server_name git.leafos.org;
	access_log /var/log/nginx/access/git.leafos.org.log;
	error_log /var/log/nginx/error/git.leafos.org.log;

	location / {
		proxy_pass http://localhost:8080/plugins/gitiles/;
		proxy_set_header Accept-Encoding "";
		proxy_cookie_domain review.leafos.org $host;
		# Rewrite Location: headers
		proxy_redirect https://localhost:8080/plugins/gitiles/ /;
		sub_filter_types *;
		sub_filter '/plugins/gitiles/' '/';
		sub_filter 'review.leafos.org Git repositories' 'LeafOS Git repositories';
		sub_filter 'Git repositories on review.leafos.org' 'Git repositories on LeafOS';
		sub_filter 'review.leafos.org</a>' 'LeafOS</a>';
		sub_filter '?format=HTML' '';
		# Redirect sign in link
		sub_filter '/login/gins%2Fgitiles%2F' '/login/git.leafos.org%2F';
		# Remove disallowed repos
		sub_filter 'href="/plugins/gitiles/All-Users/"' 'href="/plugins/gitiles/All-Users/" style="display: none;"';
		sub_filter 'href="/plugins/gitiles/All-Projects/"' 'href="/plugins/gitiles/All-Projects/" style="display: none;"';
		sub_filter 'href="/plugins/gitiles/Leaf-' 'style="display: none;" href="/plugins/gitiles/Leaf-';
		sub_filter 'href="/plugins/gitiles/OEM-' 'style="display: none;" href="/plugins/gitiles/OEM-';
		sub_filter 'href="/plugins/gitiles/PROJECT-' 'style="display: none;" href="/plugins/gitiles/PROJECT-';
		# Inject custom javascript for theme changes
		sub_filter '<head>' '<head><script type="text/javascript" src="/static/leaf-gitiles.js"></script>';
		sub_filter_once off;
	}

	location /static {
		root /var/www/git.leafos.org;
	}

	# Gerrit resources
	location /styles {
		proxy_pass http://localhost:8080;
	}
	location /fonts {
		proxy_pass http://localhost:8080;
	}
	location /favicon.ico {
		proxy_pass http://localhost:8080;
	}
	location /robots.txt {
		root /var/www/git.leafos.org/static;
	}

	# git clone
	location ~ ^.*/(HEAD|info/refs|objects/info/.*|git-(upload|receive)-pack)$ {
		proxy_pass http://localhost:8080;
	}

	ssl_certificate /etc/letsencrypt/live/leafos.org/fullchain.pem; # managed by Certbot
	ssl_certificate_key /etc/letsencrypt/live/leafos.org/privkey.pem; # managed by Certbot
}