server {
    listen                  443 ssl;
    server_name             read.nawan.my.id;
    include                 mime.types;
    access_log              /var/log/nginx/readeck.log lm_combined;
    
    # SSL
    ssl_certificate         /etc/ssl/acme/nawan.my.id.crt;
    ssl_certificate_key     /etc/ssl/acme/nawan.my.id.key;
    ssl_trusted_certificate /etc/ssl/acme/nawan.my.id.ca;

    # Internal authentication request
    location = /lmauth {
        internal;

        # FastCGI configuration
        include /etc/nginx/fastcgi_params;
        fastcgi_pass unix:/var/run/llng-fastcgi-server/llng-fastcgi.sock;
        # Drop post datas
        fastcgi_pass_request_body  off;
        fastcgi_param CONTENT_LENGTH "";
        # Prevent attacks on older Nginx versions (<1.29.5)
        fastcgi_param HTTP_HOST $host;
        # Keep original request (LLNG server will receive /lmauth)
        fastcgi_param X_ORIGINAL_URI $original_uri;
        fastcgi_param UNIQUE_ID $request_id;
        # Improve performances
        fastcgi_keep_conn on;
        fastcgi_buffer_size 32k;
        fastcgi_buffers 32 32k;
        
    }

    location / {
        proxy_pass http://127.0.0.1:8000;
        include /etc/nginx/proxy_params;
        proxy_redirect off;
        proxy_buffering off;
        client_max_body_size 50M;

        set $original_uri $uri$is_args$args;
        auth_request /lmauth;
        auth_request_set $lmremote_user $upstream_http_lm_remote_user;
        auth_request_set $lmremote_email $upstream_http_lm_remote_email;
        auth_request_set $lmlocation $upstream_http_location;
        # If CDA is used, uncomment this
        #auth_request_set $cookie_value $upstream_http_set_cookie;
        #add_header Set-Cookie $cookie_value;
        # Remove this for AuthBasic and OAuth2 handlers
        error_page 401 $lmlocation;
        # Other error pages
        error_page 403 http://auth.nawan.my.id/lmerror/403;
        error_page 404 http://auth.nawan.my.id/lmerror/404;
        error_page 500 http://auth.nawan.my.id/lmerror/500;
        error_page 502 http://auth.nawan.my.id/lmerror/502;
        error_page 503 http://auth.nawan.my.id/lmerror/503;

        # Lua snippet to automatically inject HTTP header from LLNG global configuration
        include /etc/lemonldap-ng/nginx-lua-headers.conf;

        # Uncomment to inject HTTP header manually if Nginx doesnt support Lua module
        #auth_request_set $remoteuser $upstream_http_remote_user;
        #proxy_set_header Remote-User $remoteuser;
        #auth_request_set $remoteemail $upstream_http_remote_email;
        #proxy_set_header Remote-Email $remoteemail;
   }
}

server {
    if ($host = read.nawan.my.id) {
        return 301 https://$host$request_uri;
  }
  listen 80;
  listen [::]:80;
  server_name read.nawan.my.id;
    return 404;
}