# Spark RustFS S3 — sparkr.wyrs365.com
# Public :443 is stream ssl_preread (see stream.d/spark-sni.conf).
# TLS terminates on loopback :8443; proxy HTTP to Docker rustfs on :9000.
# Signed PUT/GET keep the path as-is (/spark/...). Unsigned avatar/group
# URLs omit the bucket; only those prefixes are rewritten and publicly readable.

upstream spark_rustfs {
    server 127.0.0.1:9000;
    keepalive 32;
}

server {
    listen 80;
    listen [::]:80;
    server_name sparkr.wyrs365.com;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 127.0.0.1:8443 ssl proxy_protocol;
    listen [::1]:8443 ssl proxy_protocol;
    http2 on;
    server_name sparkr.wyrs365.com;

    ssl_certificate     /etc/letsencrypt/live/sparkr.wyrs365.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/sparkr.wyrs365.com/privkey.pem;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SparkSSL:10m;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff always;

    ignore_invalid_headers off;
    client_max_body_size 100m;
    proxy_buffering off;
    proxy_request_buffering off;
    proxy_connect_timeout 300s;
    proxy_send_timeout 300s;
    proxy_read_timeout 300s;
    proxy_http_version 1.1;
    chunked_transfer_encoding off;

    # Path-style S3 is /{bucket}/{key}. Clients often GET {public}/{object_key}.
    # Rewrite only public prefixes; chat/ and perm/fav/ stay 403 without SigV4.
    location ^~ /perm/avatar/ {
        rewrite ^ /spark$request_uri break;
        proxy_pass http://spark_rustfs;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Connection "";
        proxy_cache_convert_head off;
    }

    location ^~ /perm/group/ {
        rewrite ^ /spark$request_uri break;
        proxy_pass http://spark_rustfs;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Connection "";
        proxy_cache_convert_head off;
    }

    location / {
        proxy_pass http://spark_rustfs;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Connection "";
        proxy_cache_convert_head off;
    }
}