# THIS FILE IS MANAGED BY ANSIBLE
# code: language=ansible-jinja

{
    admin off
}

{% for env in ['production', 'staging'] %}
# Environment: {{ env }}

ipfs.local.{{ proxy_vars[env].app01.apps_base_domain }} {
    tls {{ tls_email }} {
        dns njalla {{ njalla_api_token }}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    @local {
        remote_ip {{ proxy_trusted_subnets | join(' ') }}
    }

    handle @local {
        reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
    }

    respond 403
}

ipfs-gateway.{{ proxy_vars[env].app01.apps_base_domain }},
*.ipfs.ipfs-gateway.{{ proxy_vars[env].app01.apps_base_domain }},
*.ipns.ipfs-gateway.{{ proxy_vars[env].app01.apps_base_domain }} {
    tls {{ tls_email }} {
        dns njalla {{ njalla_api_token }}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
}

xmr.local.{{ proxy_vars[env].app01.apps_base_domain }} {
    tls {{ tls_email }} {
        dns njalla {{ njalla_api_token }}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    @local {
        remote_ip {{ proxy_trusted_subnets | join(' ') }}
    }

    handle @local {
        reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
    }

    respond 403
}

cloud.{{ proxy_vars[env].app01.apps_base_domain }} {
{% if env == 'production' %}
    tls {{ tls_email }}
{% else %}
    tls {{ tls_email }} {
        dns njalla {{ njalla_api_token }}
    }
{% endif %}

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    reverse_proxy {{ proxy_vars[env].app01.internal_ipv4 }}:8080
}

{% endfor %}