{
	admin off
}

(landing_headers) {
	header {
		Strict-Transport-Security "max-age=31536000"
		X-Content-Type-Options "nosniff"
		Referrer-Policy "strict-origin-when-cross-origin"
		X-Frame-Options "SAMEORIGIN"
		-Server
	}
	encode zstd gzip
}

(static_site_csp) {
	header {
		Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://www.gooffice.ph https://mail.gooffice.ph https://rtc.gooffice.ph wss://rtc.gooffice.ph; frame-src 'self' https://www.gooffice.ph; upgrade-insecure-requests"
	}
}

gooffice.ph {
	import landing_headers
	redir https://www.gooffice.ph{uri} 308
}

chat.gooffice.ph {
	import landing_headers
	redir https://www.gooffice.ph/chat{uri} 308
}

beta-files.gooffice.ph {
	import landing_headers

	reverse_proxy gooffice-opencloud-beta:9200 {
		lb_try_duration 30s
		lb_try_interval 500ms
		header_up Host {host}
		header_up X-Real-IP {remote_host}
		header_up X-Forwarded-Host {host}
		header_up X-Forwarded-Proto {scheme}
		header_up X-Forwarded-For {remote_host}
		flush_interval -1
	}

	handle_errors {
		@temporary expression `{err.status_code} == 502 || {err.status_code} == 503 || {err.status_code} == 504`
		handle @temporary {
			header Cache-Control "no-store, no-cache, must-revalidate"
			header Pragma "no-cache"
			header Expires "0"
			root * /srv/gooffice/site
			rewrite * /errors/service-temporarily-unavailable.html
			file_server
		}

		header Cache-Control "no-store, no-cache, must-revalidate"
		header Pragma "no-cache"
		header Expires "0"
		root * /srv/gooffice/site
		rewrite * /errors/request-error.html
		file_server
	}
}

www.gooffice.ph {
	import landing_headers

	root * /srv/gooffice/site

	@officeRoot path /office
	redir @officeRoot /office-suite/ 308

	@retiredOffice path /office/* /apps/eurooffice/* /office/apps/eurooffice/*
	redir @retiredOffice /office-suite/ 308

	@portalRoot path /portal
	redir @portalRoot /portal/ 308

	@mailRoot path /mail
	redir @mailRoot /mail/ 308

	@chatRoot path /chat
	redir @chatRoot /chat/ 308

	@betaMailRoot path /beta/mail
	redir @betaMailRoot /beta/mail/ 308

	@betaChatRoot path /beta/chat
	redir @betaChatRoot /beta/chat/ 308

	@betaOfficeSuiteRoot path /beta/office-suite
	redir @betaOfficeSuiteRoot /beta/office-suite/ 308

	@betaCalendarRoot path /beta/calendar
	redir @betaCalendarRoot /beta/calendar/ 308

	@betaContactsRoot path /beta/contacts
	redir @betaContactsRoot /beta/contacts/ 308

	@ssoRoot path /sso
	redir @ssoRoot /sso/ 308

	handle /.well-known/carddav {
		redir https://mail.gooffice.ph/dav/ 301
	}
	handle /.well-known/caldav {
		redir https://mail.gooffice.ph/dav/ 301
	}
	handle /.well-known/webfinger {
		respond "GoOfficePH legacy workspace discovery is retired." 410
	}
	handle /.well-known/nodeinfo {
		respond "GoOfficePH legacy workspace discovery is retired." 410
	}
	handle /.well-known/security.txt {
		root * /srv/gooffice/site
		file_server
	}

	@keycloakAdmin path /sso/admin* /sso/admin/* /sso/realms/master* /sso/realms/master/*
	handle @keycloakAdmin {
		respond "GoOffice identity administration is restricted. Use the secured administration network or GoOffice staff portal." 403
	}

	@keycloakAccountConsole path /sso/realms/gooffice/account /sso/realms/gooffice/account/*
	redir @keycloakAccountConsole /portal/#account 302

	@documentServerPaths {
		path /healthcheck /hosting/* /web-apps/* /sdkjs/* /cache/* /coauthoring/* /converter/* /spellchecker/* /fonts/* /doc/* /welcome/*
	}
	@documentServerVersionedPaths {
		path_regexp documentServerVersion ^/[0-9]+\.[0-9]+\.[0-9]+-[^/]+/(web-apps|sdkjs|cache|coauthoring|converter|spellchecker|fonts|doc|welcome)(/.*)?$
	}
	handle @documentServerPaths {
		header Cache-Control "no-store, no-cache, must-revalidate"
		header Pragma "no-cache"
		header Expires "0"
		reverse_proxy eurooffice-docs:80 {
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-Forwarded-Host {host}
			header_up X-Forwarded-Proto {scheme}
			header_down -Cache-Control
			header_down -Pragma
			header_down -Expires
		}
	}
	handle @documentServerVersionedPaths {
		header Cache-Control "no-store, no-cache, must-revalidate"
		header Pragma "no-cache"
		header Expires "0"
		reverse_proxy eurooffice-docs:80 {
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-Forwarded-Host {host}
			header_up X-Forwarded-Proto {scheme}
			header_down -Cache-Control
			header_down -Pragma
			header_down -Expires
		}
	}

	handle /api/v1/files* {
		reverse_proxy portal-api:3000 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle /api/v1/office* {
		reverse_proxy portal-api:3000 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle /api/v1/mail* {
		reverse_proxy gooffice-mail-api:3010 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle /api/v1/* {
		reverse_proxy portal-api:3000 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle_path /api/portal/gooffice/v1/chat* {
		reverse_proxy gooffice-chat-api:3020 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle_path /api/portal/* {
		reverse_proxy portal-api:3000 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle /api/beta/files* {
		reverse_proxy portal-api:3000 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-GoOfficePH-Channel beta
		}
	}

	handle /api/beta/office* {
		reverse_proxy portal-api:3000 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-GoOfficePH-Channel beta
		}
	}

	handle /api/beta/groupware* {
		reverse_proxy portal-api:3000 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-GoOfficePH-Channel beta
		}
	}

	handle_path /api/beta/mail/* {
		reverse_proxy gooffice-mail-api:3010 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-GoOfficePH-Channel beta
		}
	}

	handle_path /api/beta/chat/* {
		reverse_proxy gooffice-chat-api:3020 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-GoOfficePH-Channel beta
		}
	}

	handle_path /api/mail/* {
		reverse_proxy gooffice-mail-api:3010 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle_path /api/chat/* {
		reverse_proxy gooffice-chat-api:3020 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle_path /mail/* {
		reverse_proxy gooffice-mail-api:3010 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle_path /chat/* {
		reverse_proxy gooffice-chat-api:3020 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
		}
	}

	handle_path /beta/mail/* {
		reverse_proxy gooffice-mail-api:3010 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-GoOfficePH-Channel beta
		}
	}

	handle_path /beta/chat/* {
		reverse_proxy gooffice-chat-api:3020 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-GoOfficePH-Channel beta
		}
	}

	handle_path /beta/office-suite/* {
		root * /srv/gooffice/site/office-suite
		file_server
	}

	handle_path /beta/calendar/* {
		root * /srv/gooffice/site/calendar
		file_server
	}

	handle_path /beta/contacts/* {
		root * /srv/gooffice/site/contacts
		file_server
	}

	handle /sso/* {
		reverse_proxy keycloak:8080 {
			lb_try_duration 30s
			lb_try_interval 500ms
			header_up Host {host}
			header_up X-Real-IP {remote_host}
			header_up X-Forwarded-Host {host}
			header_up X-Forwarded-Proto {scheme}
		}
	}

	handle {
		import static_site_csp
		try_files {path} {path}/index.html /index.html
		file_server
	}

	handle_errors {
		@temporary expression `{err.status_code} == 502 || {err.status_code} == 503 || {err.status_code} == 504`
		handle @temporary {
			header Cache-Control "no-store, no-cache, must-revalidate"
			header Pragma "no-cache"
			header Expires "0"
			rewrite * /errors/service-temporarily-unavailable.html
			file_server
		}

		header Cache-Control "no-store, no-cache, must-revalidate"
		header Pragma "no-cache"
		header Expires "0"
		rewrite * /errors/request-error.html
		file_server
	}
}
