proxy_cache_path /tmp/pdf_cache levels=1:2 keys_zone=pdf_cache:10m max_size=100m inactive=1d use_temp_path=off;

server {
    server_name labs.tidb.io labs.pingcap.com;
    listen 80;

    real_ip_header X-Forwarded-For;
    real_ip_recursive on;
    set_real_ip_from 10.100.0.0/16;

    access_log /var/log/nginx/labs.tidb.io.access.log;
    error_log /var/log/nginx/labs.tidb.io.error.log;

    add_header X-Frame-Options "SAMEORIGIN" always;

    location /tlms/user/certification/ {
        # Serve static files from the cache
	rewrite ^/tlms/user/certification/(.*)$ /user/certification/$1 break;
        root /tmp/pdf_cache;
        try_files $uri @fetch_pdf; # If file doesn't exist, fetch from upstream
    }

    # Fetch and cache PDF files
    location @fetch_pdf {
	resolver 8.8.8.8;
	set $pdf_upstream https://eng.edu.pingcap.com;
        proxy_pass $pdf_upstream;
        proxy_cache pdf_cache;                     # Enable caching
        proxy_cache_key $uri;                      # Cache key based on the URI
        proxy_cache_valid 200 30d;                  # Cache successful responses for 30 days

        # Ensure PDFs are previewable
        proxy_hide_header Content-Disposition;
        add_header Content-Disposition 'inline';
        add_header Content-Type 'application/pdf';
        # Optional: Add CORS headers if necessary
        add_header Access-Control-Allow-Origin *;

        # Pass headers to upstream
	# proxy_set_header Host $host;
        proxy_set_header Host eng.edu.pingcap.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /_next/static/ {
	limit_except GET {
        	deny all;
        }
    	proxy_http_version 1.1;
	proxy_set_header Connection "";
	proxy_set_header Authorization "";
	proxy_set_header       Host labs-public-static.s3-us-west-2.amazonaws.com;
	proxy_hide_header      x-amz-id-2;
	proxy_hide_header      x-amz-request-id;
	proxy_hide_header      x-amz-meta-server-side-encryption;
	proxy_hide_header      x-amz-server-side-encryption;
	proxy_hide_header      Set-Cookie;
	proxy_ignore_headers   Set-Cookie;
	proxy_intercept_errors on;
	add_header             Cache-Control max-age=31536000;
	proxy_pass             https://labs-public-static.s3-us-west-2.amazonaws.com/;
    }

    location /api {
	proxy_set_header X-Forwarded-Host $host;
	proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto "https";
        proxy_connect_timeout 600;
        proxy_send_timeout 600;
        proxy_read_timeout 600;
        proxy_pass http://127.0.0.1:8000;
    }

    location / {
        proxy_set_header Host $host;
	proxy_set_header X-Forwarded-Host $host;
	proxy_set_header X-Forwarded-Server $host;
	proxy_set_header X-Forwarded-Proto "https";
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 600;
        proxy_send_timeout 600;
        proxy_read_timeout 600;
        # proxy_buffering off;
	if ($host = labs.tidb.io) {
	  set $node_port 13100;
	}
	if ($host = labs.pingcap.com) {
	  set $node_port 13200;
	}
        proxy_pass http://127.0.0.1:$node_port;
    }
}