{%- set url = slave_parameter.get('url') %}
{%- set https_url = slave_parameter.get('https-url', url) %}
{%- if url.startswith("http://") or url.startswith("https://") %}
{%-   set upstream = url.split("/")[2] %}
{%-   set https_upstream = https_url.split("/")[2] %}

# SSL-enabled
{% set ssl = {} %}
{% if os_module.path.exists(slave_parameter['certificate']) %}
{%   do ssl.__setitem__('certificate', slave_parameter['certificate']) %}
{%   do ssl.__setitem__('key', slave_parameter['certificate']) %}
{#- BBB: SlapOS Master non-zero knowledge BEGIN -#}
{% elif 'path_to_ssl_crt' in slave_parameter and 'path_to_ssl_key' in slave_parameter %}
{%   do ssl.__setitem__('certificate', slave_parameter['path_to_ssl_crt']) %}
{%   do ssl.__setitem__('key', slave_parameter['path_to_ssl_key']) %}
{% elif os_module.path.getsize(slave_parameter['apache_certificate']) > 0 and os_module.path.getsize(slave_parameter['apache_key']) > 0 %}
{%   do ssl.__setitem__('certificate', slave_parameter['apache_certificate']) %}
{%   do ssl.__setitem__('key', slave_parameter['apache_key']) %}
{% endif %}
{#- BBB: SlapOS Master non-zero knowledge END -#}
{% if 'key' in ssl %}
https://{{ slave_parameter.get('custom_domain') }}:{{ slave_parameter['nginx_https_port'] }} {
  bind {{ slave_parameter['local_ipv4'] }}
  # Compress the output
  gzip
  log / {{ slave_parameter.get('access_log') }} "{remote} - {>REMOTE_USER} [{when}] \"{method} {uri} {proto}\" {status} {size} \"{>Referer}\" \"{>User-Agent}\" {latency_ms}"
  errors {{ slave_parameter.get('error_log') }}

  tls {{ ssl['certificate'] }} {{ ssl['key'] }} {
    alpn http/1.1
  }

  proxy / {{ https_upstream }} {
    try_duration {{ slave_parameter['proxy_try_duration'] }}s
    try_interval {{ slave_parameter['proxy_try_interval'] }}ms
    transparent
    insecure_skip_verify
  }
  rewrite {
    regexp "/(api/kernels/[^/]+/(channels|iopub|shell|stdin)|terminals/websocket)/?"
    to /proxy/{1}
  }
  proxy /proxy/ {{ https_upstream }} {
    try_duration {{ slave_parameter['proxy_try_duration'] }}s
    try_interval {{ slave_parameter['proxy_try_interval'] }}ms
    header_upstream X-Real-IP {remote}
    header_upstream Host {host}
    websocket
    without /proxy/
    insecure_skip_verify
  }
}
{% endif %}

# SSL-disabled
http://{{ slave_parameter.get('custom_domain') }}:{{ slave_parameter['nginx_http_port'] }} {
  bind {{ slave_parameter['local_ipv4'] }}
  # Compress the output
  gzip
  log / {{ slave_parameter.get('access_log') }} "{remote} - {>REMOTE_USER} [{when}] \"{method} {uri} {proto}\" {status} {size} \"{>Referer}\" \"{>User-Agent}\" {latency_ms}"
  errors {{ slave_parameter.get('error_log') }}

  proxy / {{ upstream }} {
    try_duration {{ slave_parameter['proxy_try_duration'] }}s
    try_interval {{ slave_parameter['proxy_try_interval'] }}ms
    transparent
    insecure_skip_verify
  }
  rewrite {
    regexp "/(api/kernels/[^/]+/(channels|iopub|shell|stdin)|terminals/websocket)/?"
    to /proxy/{1}
  }
  proxy /proxy/ {{ upstream }} {
    try_duration {{ slave_parameter['proxy_try_duration'] }}s
    try_interval {{ slave_parameter['proxy_try_interval'] }}ms
    header_upstream X-Real-IP {remote}
    header_upstream Host {host}
    websocket
    without /proxy/
    insecure_skip_verify
  }
}
{%- endif %}
