---

allow_duplicates: yes

dependencies:
  - role: misc/system_user
    # system_user
    # user_directory
    user_directory_group: "{{ global_nginx_system_user }}"
  - role: misc/backup_files
    # domain
    backup_directory: "{{ nextcloud_data_directory }}"
  - role: misc/hdd_dir
    # domain
    hdd_source_dir: "{{ nextcloud_data_directory }}"
  - role: mysql/database
    # database_user
  - role: nginx/php-pool
    # system_user
    src: "{{ nextcloud_installation_directory }}"
    includes:
      - "{{ nextcloud_installation_directory }}/apps"
    admin_values:
      memory_limit: 1G
      post_max_size: "{{ php_post_max_size }}"
      upload_max_size: "{{ php_upload_max_size }}"
  - role: redis/instance
    # domain
    # system_user
    # user_directory
  - role: nginx/server
    directives: |
      add_header X-Download-Options "noopen" always;
      add_header X-Permitted-Cross-Domain-Policies "none" always;
      add_header X-Robots-Tag "none" always;
      fastcgi_hide_header X-Powered-By;
      root {{ nextcloud_installation_directory }};
      location = /.well-known/carddav {
        return 301 $scheme://$host:$server_port/remote.php/dav;
      }
      location = /.well-known/caldav {
        return 301 $scheme://$host:$server_port/remote.php/dav;
      }
      rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
      rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
      rewrite ^/.well-known/webfinger /public.php?service=webfinger last;
      client_max_body_size {{ nginx_max_size }};
      #fastcgi_buffers 64 4K;
      location / {
        rewrite ^ /index.php;
      }
      location ~ ^\/(?:build|tests|config|lib|3rdparty|templates|data)\/ {
        deny all;
      }
      location ~ ^\/(?:\.|autotest|occ|issue|indie|db_|console) {
        deny all;
      }
      location ~ ^\/(?:index|remote|public|cron|core\/ajax\/update|status|ocs\/v[12]|updater\/.+|oc[ms]-provider\/.+|.+\/richdocumentscode\/proxy)\.php(?:$|\/) {
        fastcgi_split_path_info ^(.+?\.php)(\/.*|)$;
        set $path_info $fastcgi_path_info;
        try_files $fastcgi_script_name =404;
        include {{ global_nginx_installation_directory }}/fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $path_info;
        fastcgi_param HTTPS on;
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass {{ pool_name }};
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
      }
      location ~ ^\/(?:updater|oc[ms]-provider)(?:$|\/) {
        try_files $uri/ =404;
        index index.php;
      }
      location ~ \.(?:css|js|woff2?|svg|gif|map)$ {
        try_files $uri /index.php$request_uri;
        add_header Cache-Control "public, max-age=15778463";
        add_header Referrer-Policy "no-referrer" always;
        add_header X-Content-Type-Options "nosniff" always;
        add_header X-Download-Options "noopen" always;
        add_header X-Frame-Options "SAMEORIGIN" always;
        add_header X-Permitted-Cross-Domain-Policies "none" always;
        add_header X-Robots-Tag "none" always;
        add_header X-XSS-Protection "1; mode=block" always;
        access_log off;
      }

      location ~ \.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$ {
        try_files $uri /index.php$request_uri;
        access_log off;
      }
      {% if status_page_path is defined and status_page_path|length -%}
      location {{ status_page_path }} {
        {{ status_page_acl | indent(width=2) }}
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        fastcgi_index index.php;
        include {{ global_nginx_installation_directory }}/fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param HTTPS on;
        fastcgi_param modHeadersAvailable true;
        fastcgi_param front_controller_active true;
        fastcgi_pass {{ pool_name }};
        fastcgi_intercept_errors on;
        fastcgi_request_buffering off;
      }
      {%- endif %}