upstream evok {
        server 127.0.0.1:8080; #port Evok runs on, change this line only if you change the port in configuration of Evok
}

# HTTP is redirected to HTTPS, the token of Evok is not sent as plain text
server {
	listen 80 default_server;
	server_name  _;
	access_log  off;
	# the errors in the system log only: journalctl -t evok_web
	error_log syslog:server=unix:/dev/log,tag=evok_web,nohostname warn;

	return 301 https://$host$request_uri;
}

server {
	listen 443 ssl default_server;
	server_name  _;

	# the self-signed certificate of the controller, generated by the package ssl-cert; a browser warns
	# about it until it is accepted. Your own certificate: replace the include by
	#   ssl_certificate      /etc/ssl/certs/<your>.pem;
	#   ssl_certificate_key  /etc/ssl/private/<your>.key;
	include snippets/snakeoil.conf;
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_session_cache shared:EvokSSL:1m;

	# the requests are not logged, each would be a write to the flash of the controller
	#access_log syslog:server=unix:/dev/log,tag=evok_web,nohostname combined;
	access_log  off;
	# the errors in the system log only: journalctl -t evok_web
	error_log syslog:server=unix:/dev/log,tag=evok_web,nohostname warn;

	root /opt/evok/www;

	# the headers of the requests to Evok, inherited by the locations without their own proxy_set_header;
	# the address of the client is the one of the connection, a forged X-Forwarded-For of a client is not passed
	proxy_set_header Host $host:$server_port;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $remote_addr;
	proxy_set_header X-Forwarded-Proto $scheme;

	location / {
	    index index.html;
	}

	location /favicon.ico {
		alias /opt/evok/www/favicon.ico;
	}

	location /ws {
		proxy_pass http://evok;
		# its own proxy_set_header, the headers of the server are not inherited
		proxy_set_header Host $host:$server_port;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "upgrade";
		proxy_buffering off;
		proxy_cache off;
		proxy_read_timeout 180;
	}

	# Evok refuses a request without its token by 401 with "WWW-Authenticate: Basic", a browser would show
	# its own login dialog instead of the dialog of the token of evok-web
	location /rest {
		proxy_pass http://evok;
		proxy_hide_header WWW-Authenticate;
	}

	location /json {
		proxy_pass http://evok;
		proxy_hide_header WWW-Authenticate;
	}
	location /bulk {
		proxy_pass http://evok;
		proxy_hide_header WWW-Authenticate;
	}
	location /rpc {
		proxy_pass http://evok;
		proxy_hide_header WWW-Authenticate;
	}
	location /version {
		proxy_pass http://evok;
	}

}
