<commit_before>server {
    listen 80;
    server_name <%= @name %> a.<%= @name %> b.<%= @name %> c.<%= @name %><% @aliases.each do |alias_name| %> <%= alias_name %> a.<%= alias_name %> b.<%= alias_name %> c.<%= alias_name %><%- end -%>;

    rewrite ^/\.well-known/acme-challenge/(.*)$ http://acme.openstreetmap.org/.well-known/acme-challenge/$1 permanent;
    return 301 https://$host$request_uri;
}

upstream <%= @name %>_fastcgi {
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-0.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-1.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-2.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-3.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-4.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-5.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-6.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-7.socket" max_fails=0;

    # Use default round-robin to distribute requests, rather than pick "fast" but maybe faulty.
    # Do not use keepalive
}

server {
    listen 443 ssl http2;
    server_name <%= @name %> a.<%= @name %> b.<%= @name %> c.<%= @name %><% @aliases.each do |alias_name| %> <%= alias_name %> a.<%= alias_name %> b.<%= alias_name %> c.<%= alias_name %><%- end -%>;

    ssl_certificate /etc/ssl/certs/<%= @name %>.pem;
    ssl_certificate_key /etc/ssl/private/<%= @name %>.key;
<% if node[:ssl][:strict_transport_security] -%>

    add_header Strict-Transport-Security "<%= node[:ssl][:strict_transport_security] %>" always;
<% end -%>

    # Requests sent within early data are subject to replay attacks.
    # See: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data
    ssl_early_data on;

    root "/srv/<%= @name %>";

    gzip on;
    gzip_types text/plain text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml; # text/html is implicit
    gzip_min_length 512;
    gzip_http_version 1.0;
    gzip_proxied any;
    gzip_comp_level 9;
    gzip_vary on;

    # Include site imagery layers
    include /srv/imagery/nginx/<%= @name %>/layer-*.conf;
}<commit_msg>imagery: Add report only CSP and NEL reporting<commit_after>server {
    listen 80;
    server_name <%= @name %> a.<%= @name %> b.<%= @name %> c.<%= @name %><% @aliases.each do |alias_name| %> <%= alias_name %> a.<%= alias_name %> b.<%= alias_name %> c.<%= alias_name %><%- end -%>;

    rewrite ^/\.well-known/acme-challenge/(.*)$ http://acme.openstreetmap.org/.well-known/acme-challenge/$1 permanent;
    return 301 https://$host$request_uri;
}

upstream <%= @name %>_fastcgi {
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-0.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-1.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-2.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-3.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-4.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-5.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-6.socket" max_fails=0;
    server "unix:/var/run/mapserver-fastcgi/layer-<%= @name %>-7.socket" max_fails=0;

    # Use default round-robin to distribute requests, rather than pick "fast" but maybe faulty.
    # Do not use keepalive
}

server {
    listen 443 ssl http2;
    server_name <%= @name %> a.<%= @name %> b.<%= @name %> c.<%= @name %><% @aliases.each do |alias_name| %> <%= alias_name %> a.<%= alias_name %> b.<%= alias_name %> c.<%= alias_name %><%- end -%>;

    ssl_certificate /etc/ssl/certs/<%= @name %>.pem;
    ssl_certificate_key /etc/ssl/private/<%= @name %>.key;
<% if node[:ssl][:strict_transport_security] -%>

    add_header Strict-Transport-Security "<%= node[:ssl][:strict_transport_security] %>" always;
<% end -%>

    # CSP report only policy
    add_header Content-Security-Policy-Report-Only "default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://openstreetmap.report-uri.com/r/d/csp/wizard";
    # Add NEL reporting
    add_header Report-To "{\"group\":\"default\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://openstreetmap.report-uri.com/a/d/g\"}],\"include_subdomains\":true}";
    add_header NEL "{\"report_to\":\"default\",\"max_age\":604800,\"include_subdomains\":true}";

    # Requests sent within early data are subject to replay attacks.
    # See: http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data
    ssl_early_data on;

    root "/srv/<%= @name %>";

    gzip on;
    gzip_types text/plain text/css application/json application/javascript application/x-javascript text/javascript text/xml application/xml application/rss+xml application/atom+xml application/rdf+xml image/svg+xml; # text/html is implicit
    gzip_min_length 512;
    gzip_http_version 1.0;
    gzip_proxied any;
    gzip_comp_level 9;
    gzip_vary on;

    # Include site imagery layers
    include /srv/imagery/nginx/<%= @name %>/layer-*.conf;
}
{'fraction_non_alphanumeric': 0.19227213902754667, 'fraction_numerical': 0.014050656313551489, 'mean_word_length': 3.7960992907801416, 'pattern_counts': {'":': 8, '<': 75, '<?xml version=': 0, '>': 75, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 12}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5626254', 'n_tokens_mistral': 2189, 'n_tokens_neox': 1945, 'n_words': 392}