real_ip_header X-Forwarded-For;
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.0.0.0/8;
real_ip_recursive on;

upstream fastcgi_backend {
  # use tcp connection
  server app:9000;
}

server {
  listen 8090;
  server_name _;
  set $MAGE_ROOT /var/www/public;
  resolver 127.0.0.11;

  root $MAGE_ROOT/pub;

  index index.php;
  autoindex off;
  charset UTF-8;
  client_max_body_size 64M;
  error_page 404 403 = /errors/404.php;

  location / {
    try_files $uri $uri/ /index.php$is_args$args;
  }

  location /favicon/ {
      alias /var/www/public/pub/favicon/;
  }

  location /pub/ {
      location ~ ^/pub/media/(downloadable|customer|import|theme_customization/.*\.xml) {
          deny all;
      }
      alias $MAGE_ROOT/pub/;
      add_header X-Frame-Options "SAMEORIGIN";
  }

  location /static/ {
      # Uncomment the following line in production mode
      # expires max;

      # Remove signature of the static files that is used to overcome the browser cache
      location ~ ^/static/version {
          rewrite ^/static/(version[^/]+/)?(.*)$ /static/$2 last;
      }

      # If webp image is not found try the same file name with .jpg
      location ~* \.(webp)$ {
          try_files $uri @webp-to-jpg;
      }

      location ~* \.(ico|webp|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
          add_header Cache-Control "public";
          add_header X-Frame-Options "SAMEORIGIN";
          expires +1y;

          if (!-f $request_filename) {
              rewrite ^/static/?(.*)$ /static.php?resource=$1 last;
          }
      }
      location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
          add_header Cache-Control "no-store";
          add_header X-Frame-Options "SAMEORIGIN";
          expires    off;

          if (!-f $request_filename) {
             rewrite ^/static/?(.*)$ /static.php?resource=$1 last;
          }
      }
      if (!-f $request_filename) {
          rewrite ^/static/?(.*)$ /static.php?resource=$1 last;
      }
      add_header X-Frame-Options "SAMEORIGIN";
  }
  
  location /.well-known/ {
      try_files $uri $uri/ =404;
  }
  location /media/ {
      try_files $uri $uri/ /get.php$is_args$args;

      location ~ ^/media/theme_customization/.*\.xml {
          deny all;
      }

      # If webp image is not found try the same file name with .jpg
      location ~* \.(webp)$ {
          try_files $uri @webp-to-jpg;
      }

      location ~* \.(ico|webp|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ {
          add_header Cache-Control "public";
          add_header X-Frame-Options "SAMEORIGIN";
          expires +1y;
          try_files $uri $uri/ /get.php$is_args$args;
      }
      location ~* \.(zip|gz|gzip|bz2|csv|xml)$ {
          add_header Cache-Control "no-store";
          add_header X-Frame-Options "SAMEORIGIN";
          expires    off;
          try_files $uri $uri/ /get.php$is_args$args;
      }
      add_header X-Frame-Options "SAMEORIGIN";
  }

  location /media/customer/ {
      deny all;
  }

  location /media/downloadable/ {
      deny all;
  }

  location /media/import/ {
      deny all;
  }

  # PHP entry point for main application
  location ~ (index|get|static|report|404|503|health_check)\.php$ {
      try_files $uri =404;
      fastcgi_pass   fastcgi_backend;
      fastcgi_buffers 16 16k;
      fastcgi_buffer_size 32k;

      fastcgi_param  PHP_FLAG  "session.auto_start=off \n suhosin.session.cryptua=off";
      fastcgi_param  PHP_VALUE "memory_limit=756M \n max_execution_time=18000";
      fastcgi_read_timeout 600s;
      fastcgi_connect_timeout 600s;

      fastcgi_index  index.php;
      fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
      include        fastcgi_params;
  }

  gzip on;
  gzip_disable "msie6";

  gzip_comp_level 6;
  gzip_min_length 1100;
  gzip_buffers 16 8k;
  gzip_proxied any;
  gzip_types
      text/plain
      text/css
      text/js
      text/xml
      text/javascript
      application/javascript
      application/x-javascript
      application/json
      application/xml
      application/xml+rss
      image/svg+xml;
  gzip_vary on;

  # Banned locations (only reached if the earlier PHP entry point regexes don't match)
  location ~* (\.php$|\.htaccess$|\.git) {
      deny all;
  }

  # Fallback to .jpg files for webp files if they are not found.
  location @webp-to-jpg {
      rewrite ^(.*)\.webp$ $1.jpg last;
  }
}