server_tokens off;
client_header_buffer_size 512;
client_max_body_size 512;

server {
    listen 80 default;
    listen [::]:80 ipv6only=on default;

    rewrite ^ https://$host$uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ipv6only=on ssl;

    root /var/www/fic-server/htdocs/;

    server_tokens off;

    access_log /var/log/nginx/fic.access_log;
    error_log /var/log/nginx/fic.error_log;

    ssl_certificate		/var/www/fic-server/server.crt;
    ssl_certificate_key		/var/www/fic-server/server.key;
    ssl_protocols		TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers	on;
    ssl_ciphers			ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!ADH:!AECDH:!MD5:!DSS;
    ssl_client_certificate	/var/www/fic-server/cacert.crt;
    ssl_verify_client		optional;
    ssl_crl			/var/www/fic-server/crl.pem;

    add_header Strict-Transport-Security "max-age=2592000; includeSubdomains";

    error_page 400 /errors/400/index.html;
    error_page 403 /errors/403/index.html;
    error_page 404 /errors/404/index.html;
    error_page 413 414 /errors/413/index.html;
    error_page 500 503 /errors/500/index.html;
    error_page 502 504 /errors/502/index.html;

    location /
    {
	default_type text/html;
	expires epoch;

	set $team 0;

        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Amin_Martin/") { set $team 343; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Bernard_Angoustures/") { set $team 344; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Cacace_Diallo/") { set $team 345; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Delaporte_Notebaert/") { set $team 346; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Dibe/") { set $team 347; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Dubief_Roccia/") { set $team 348; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Ezzahoui/") { set $team 349; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Fall/") { set $team 350; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Guerin_Chapiron/") { set $team 351; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Hugot_Hincelin/") { set $team 352; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Jawor_Giraud/") { set $team 353; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Konan/") { set $team 354; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Le_Mignan_Yadaba/") { set $team 355; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Michel-villaz_Gzenayi/") { set $team 356; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Muller_Perrin/") { set $team 357; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Pourcelot/") { set $team 358; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Quint_Kaczmarek/") { set $team 359; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Ruff_Czarny/") { set $team 360; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Sinet_Girault/") { set $team 361; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Therrode/") { set $team 362; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Sabono_Calmeji/") { set $team 363; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=Renaud_Vandemeulebroucke/") { set $team 364; }
        if ($ssl_client_s_dn ~ "/C=FR/ST=France/O=Epita/OU=SRS/CN=De_Priest_Tjonck/") { set $team 365; }

	if ($team) {
            root /var/www/fic-server/teams/$team$1;
	    rewrite ^/([0-9]+-?[a-zA-Z0-9_-]*)/([a-zA-Z0-9_]+)/submission$ /submission.php?team=$team&theme=$1&exercice=$2 last;
        }
	if ($team = 0) {
	    root /var/www/fic-server/htdocs/;
	}
    }

    location /errors
    {
	root /var/www/fic-server/;
    }

    location /connected
    {
        return 403;
    }

    location /files
    {
        root /var/www/fic-server/;

    	aio on;
    	directio 512;
    	output_buffers 1 128k;
    }

    location ~* \favicon.ico$ {
	root /var/www/fic-server/htdocs/;
        access_log off;
        expires 1d;
        add_header Cache-Control public;
    }

    location ~ ^/(assets|img|js|css|fonts)/ {
	root /var/www/fic-server/htdocs/;
        access_log off;
        expires 7d;
        add_header Cache-Control public;
    }

    location ~ /(\.ht|\.git|\.svn|\.onyx) {
        return 403;
    }

    location /submission.php
    {
	root	      /var/www/fic-server/;

    	limit_rate       4k;

        include       /etc/nginx/fastcgi.conf;
        fastcgi_pass  unix:/var/run/php-fpm.sock;
	break;
    }
}