{{- if .Values.nginx.enabled }}
{{- $rootDomain := printf "%s.svc.%s:%d" .Release.Namespace .Values.clusterDomain (.Values.config.server.http_listen_port | int) }}
kind: ConfigMap
apiVersion: v1
metadata:
  name: {{ include "cortex.nginxFullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "cortex.nginxLabels" . | nindent 4 }}
data:
  nginx.conf: |-
    worker_processes  5;  ## Default: 1
    error_log  /dev/stderr;
    pid        /tmp/nginx.pid;
    worker_rlimit_nofile 8192;

    events {
      worker_connections  4096;  ## Default: 1024
    }

    {{- with .Values.nginx.config.mainSnippet }}
    {{ tpl . $ | nindent 4 }}
    {{- end }}

    http {
      default_type application/octet-stream;
      client_max_body_size {{.Values.nginx.config.client_max_body_size}};
      log_format   main '$remote_addr - $remote_user [$time_local]  $status '
        '"$request" $body_bytes_sent "$http_referer" '
        '"$http_user_agent" "$http_x_forwarded_for" $http_x_scope_orgid';
      access_log   /dev/stderr  main;
      sendfile     on;
      tcp_nopush   on;
      resolver {{ default (printf "coredns.kube-system.svc.%s" .Values.clusterDomain ) .Values.nginx.config.dnsResolver }};

      {{- with .Values.nginx.config.httpSnippet }}
      {{ tpl . $ | nindent 6 }}
      {{- end }}

      server { # simple reverse-proxy
        listen {{ .Values.nginx.http_listen_port }};
        proxy_connect_timeout 300s;
        proxy_send_timeout 300s;
        proxy_read_timeout 300s;
        proxy_http_version 1.1;
        proxy_set_header X-Scope-OrgID 0;

        {{- range $key, $value := .Values.nginx.config.setHeaders }}
        proxy_set_header {{ $key }} {{ $value }};
        {{- end }}

        {{ if .Values.nginx.config.basicAuthSecretName -}}
        auth_basic "Restricted Content";
        auth_basic_user_file /etc/apache2/.htpasswd;
        {{- end }}

        {{- with .Values.nginx.config.serverSnippet }}
        {{ tpl . $ | nindent 8 }}
        {{- end }}

        location = /healthz {
          # auth_basic off is not set here, even when a basic auth directive is
          # included in the server block, as Nginx's NGX_HTTP_REWRITE_PHASE
          # (point when this return statement is evaluated) comes before the
          # NGX_HTTP_ACCESS_PHASE (point when basic auth is evaluated). Thus,
          # this return statement returns a response before basic auth is
          # evaluated.
          return 200 'alive';
        }

        # Distributor Config
        location = /ring {
          proxy_pass      http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
        }

        location = /all_user_stats {
          proxy_pass      http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
        }

        location = /api/prom/push {
          proxy_pass      http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
        }

        ## New Remote write API. Ref: https://cortexmetrics.io/docs/api/#remote-write
        location = /api/v1/push {
          proxy_pass      http://{{ template "cortex.fullname" . }}-distributor.{{ $rootDomain }}$request_uri;
        }

        # Alertmanager Config
        location ~ /api/prom/alertmanager/.* {
          proxy_pass      http://{{ template "cortex.fullname" . }}-alertmanager.{{ $rootDomain }}$request_uri;
        }

        location ~ /api/v1/alerts {
          proxy_pass      http://{{ template "cortex.fullname" . }}-alertmanager.{{ $rootDomain }}$request_uri;
        }

        location ~ /multitenant_alertmanager/status {
          proxy_pass      http://{{ template "cortex.fullname" . }}-alertmanager.{{ $rootDomain }}$request_uri;
        }

        # Ruler Config
        location ~ /api/v1/rules {
          proxy_pass      http://{{ template "cortex.fullname" . }}-ruler.{{ $rootDomain }}$request_uri;
        }

        location ~ /ruler/ring {
          proxy_pass      http://{{ template "cortex.fullname" . }}-ruler.{{ $rootDomain }}$request_uri;
        }

        # Config Config
        location ~ /api/prom/configs/.* {
          proxy_pass      http://{{ template "cortex.fullname" . }}-configs.{{ $rootDomain }}$request_uri;
        }

        # Query Config
        location ~ /api/prom/.* {
          proxy_pass      http://{{ template "cortex.fullname" . }}-query-frontend.{{ $rootDomain }}$request_uri;
        }

        ## New Query frontend APIs as per https://cortexmetrics.io/docs/api/#querier--query-frontend
        location ~ ^{{.Values.config.api.prometheus_http_prefix}}/api/v1/(read|metadata|labels|series|query_range|query) {
          proxy_pass      http://{{ template "cortex.fullname" . }}-query-frontend.{{ $rootDomain }}$request_uri;
        }

        location ~ {{.Values.config.api.prometheus_http_prefix}}/api/v1/label/.* {
          proxy_pass      http://{{ template "cortex.fullname" . }}-query-frontend.{{ $rootDomain }}$request_uri;
        }
        {{- if and (.Values.config.auth_enabled) (.Values.nginx.config.auth_orgs) }}
        # Auth orgs
        {{- range $org := compact .Values.nginx.config.auth_orgs | uniq }}
        location = /api/v1/push/{{ $org }} {
          proxy_set_header      X-Scope-OrgID {{ $org }};
          proxy_pass      http://{{ template "cortex.fullname" $ }}-distributor.{{ $rootDomain }}/api/v1/push;
        }
        {{- end }}
        {{- end }}
      }
    }
{{- end }}
