galaxy-main.j2

proxy_cache_path {{ nginx_cache_dir }} levels=1:2 keys_zone=galaxy:50m max_size=5g inactive=12h use_temp_path=off;

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

upstream galaxy {
    keepalive 64;
    {% for n in range(galaxy_systemd_gunicorns) %}
        server unix:{{ galaxy_mutable_data_dir }}/{{ galaxy_systemd_gunicorn_socket_name }}_{{ n }}.sock;
    {% endfor %}
}

{% macro upstream_galaxy() -%}
# This is the backend to send the requests to.
proxy_pass          http://galaxy;

proxy_set_header Host               $host;
proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto  $scheme;
proxy_set_header Upgrade            $http_upgrade;
{%- endmacro %}

{% macro upstream_galaxy_cache() -%}
{# Must be used together with `upstream_galaxy()`. #}
proxy_cache galaxy;

proxy_cache_key $scheme$host$proxy_host$request_uri;

proxy_cache_valid 200 30m;
proxy_cache_valid 404 5m;
proxy_cache_valid any 10m;

proxy_cache_revalidate off;
# could be set `on` if upstream gunicorn provides `etag` or `last-modified` headers (don't know)

proxy_ignore_headers Cache-Control Expires;

proxy_cache_use_stale updating error timeout http_500 http_502 http_503 http_504;

# useful for debugging, takes the values MISS, HIT, EXPIRED, STALE or REVALIDATED
add_header X-Cache $upstream_cache_status;

expires 24h;
{%- endmacro %}

server {
    listen 443 default_server;
    listen [::]:443 default_server;

    error_page 404 /404.html;
    error_page 502 /502.html;
    error_page 503 /503.html;
    error_page 504 /503.html;

    location /404.html {
        root /usr/share/nginx/html;
        internal;
    }
    location /502.html {
        root /usr/share/nginx/html;
        internal;
    }
    location /503.html {
        root /usr/share/nginx/html;
        internal;
    }
    location /504.html {
        root /usr/share/nginx/html;
        internal;
    }

    # Move to remote storage, hopefully hammer local disk slightly less?
    #client_body_temp_path  /data/dnb01/nginx_upload_store/;
    client_body_buffer_size 1024m;

    # Long-lived Server-Sent Events stream.
    # Galaxy sends ``X-Accel-Buffering: no`` on the response, which
    # disables nginx response buffering just for this endpoint.
    # The keepalive comment fires every 30s so the read timeout
    # only needs to be a comfortable margin above that.
    location /api/events/stream {
        {{ upstream_galaxy() | indent(8, false) }}

        proxy_http_version 1.1;
        proxy_set_header Connection "";

        # Disable buffering and gzip explicitly. ``X-Accel-Buffering``
        # already does this, but pinning it here also covers setups
        # where a sub-filter strips upstream headers.
        proxy_buffering off;
        proxy_cache off;
        gzip off;

        # Keepalives fire every 30s; allow generous slack on top.
        proxy_read_timeout 10m;
        proxy_send_timeout 10m;
    }

    location / {
        {{ upstream_galaxy() | indent(8, false) }}
        proxy_set_header Connection         $connection_upgrade;

        # Throttle downloads. First 100Mb are free, after that 5Mb/s.
        # users can move to FTP if they need / we can sort that out.
        limit_rate_after 100m;
        limit_rate 5m;

        add_header X-Clacks-Overhead 'GNU James Taylor (@jxtx) Simon Gladman (@slugger70) Jim Johnson (@jj-umn)';
    }

    # Temporarily break downloading :(
    #location /api/libraries/datasets/download/ {
    #    return 302 https://usegalaxy.eu;
    #}
    #location /history/export_archive {
    #    return 302 https://usegalaxy.eu;
    #}

    location ~ ^/api/dataset_collections/([^/]+)/download/?$ {
        {{ upstream_galaxy() | indent(8, false) }}

        proxy_read_timeout 1200s;

        proxy_buffering off;
    }

    location /_x_accel_redirect {
        internal;
        alias /;
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-Content-Type-Options nosniff;

        # CORS
        if ($http_origin ~ "^https?://(covid19map\.elixir-luxembourg\.org|avivator\.gehlenborglab\.org|www\.bx\.psu\.edu)$") {
            add_header Access-Control-Allow-Origin $http_origin;
            add_header Access-Control-Allow-Methods 'GET';
            add_header Access-Control-Expose-Headers 'Content-Length,Content-Range';
            add_header Access-Control-Allow-Headers 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
        }
    }

    location /_upload {
        upload_store {{ galaxy_config['galaxy']['nginx_upload_store'] }};
        upload_limit_rate 32k;
        upload_store_access user:rw group:rw all:rw;
        upload_pass_form_field "";
        upload_set_form_field "__${upload_field_name}__is_composite" "true";
        upload_set_form_field "__${upload_field_name}__keys" "name path";
        upload_set_form_field "${upload_field_name}_name" "$upload_file_name";
        upload_set_form_field "${upload_field_name}_path" "$upload_tmp_path";
        upload_pass_args on;
        upload_pass /_upload_done;
    }

    location /_upload_done {
        set $dst /api/tools;
        if ($args ~ nginx_redir=([^&]+)) {
                set $dst $1;
        }
        rewrite "" $dst;
    }

    location /_job_files {
        if ($request_method != POST) {
                rewrite "" /api/jobs/$arg_job_id/files last;
        }
        upload_store {{ galaxy_config['galaxy']['nginx_upload_job_files_store'] }};
                # the rate limit might be needed if we have many Pulsar jobs that are writing data back
        # we need to limit it because the disc IO can be too large, ideally this happens on a different node
                # upload_limit_rate 32k;
        upload_store_access user:rw group:rw all:rw;
        upload_pass_form_field "";
        upload_set_form_field "__${upload_field_name}_path" "$upload_tmp_path";
        upload_pass_args on;
        upload_pass /_upload_job_files_done;
    }

    location /_upload_job_files_done {
        internal;
        rewrite "" /api/jobs/$arg_job_id/files;
    }

    location /api/upload/resumable_upload {
        # Disable request and response buffering
        proxy_request_buffering  off;
        proxy_buffering          off;
        proxy_http_version       1.1;

        # Add X-Forwarded-* headers
        proxy_set_header X-Forwarded-Host   $host;
        proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto  $scheme;

        proxy_set_header         Upgrade $http_upgrade;
        proxy_set_header         Connection "upgrade";
        client_max_body_size     0;
        proxy_pass http://upload.bi.privat:1081/api/upload/resumable_upload;
    }

    location /phinch {
        root /opt;
    }

    location /static {
        {{ upstream_galaxy() | indent(8, false) }}
        {{ upstream_galaxy_cache() | indent(8, false) }}
    }

    location /static/vgcn {
        expires 24h;
        autoindex on;
        alias /data/dnb01/vgcn/;
    }
    location /static/share {
        expires 24h;
        autoindex on;
        alias /data/dnb01/share/;
    }

    location ~ ^/plugins/(?<plug_type>[^/]+?)/((?<vis_d>[^/_]*)_?)?(?<vis_name>[^/]*?)/static/(?<static_file>.*?)$ {
        alias /opt/galaxy/config/plugins/$plug_type/;
        try_files $vis_d/${vis_d}_${vis_name}/static/$static_file
                  $vis_d/static/$static_file =404;
    }

    # Global GIE configuration
    location /gie_proxy {
        proxy_pass http://127.0.0.1:8800/gie_proxy;
        proxy_redirect off;
    }

    # Project Jupyter specific. Other IEs may require their own routes.
    location ~ ^/gie_proxy/jupyter/(?<nbtype>[^/]+)/api/kernels(?<rest>.*?)$ {
        proxy_pass http://127.0.0.1:8800/gie_proxy/jupyter/$nbtype/api/kernels$rest;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    # Route all path-based interactive tool requests to the InteractiveTool proxy application
    location ~* ^/(interactivetool/.+)$ {
            proxy_redirect      off;
            proxy_http_version  1.1;
            proxy_set_header    Host            $host;
            proxy_set_header    X-Real-IP       $remote_addr;
            proxy_set_header    Upgrade         $http_upgrade;
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header    Connection      "upgrade";
            proxy_hide_header   X-Frame-Options;
            add_header          X-Frame-Options "SAMEORIGIN";
            proxy_pass          http://127.0.0.1:{{ gie_proxy_port }};
        }

    location = /.well-known/security.txt {
        alias /etc/nginx/security.txt;
        default_type text/plain;
        add_header Cache-Control "no-store";
    }

    location /.well-known/ {
        proxy_pass          http://127.0.0.1:8118;
        proxy_set_header    Host                $host;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Proto   $scheme;
        proxy_pass_request_headers on;
    }

    {{ gapars_nginx_config }}

    location /apollo/ {
        proxy_pass http://apollo.bi.privat/apollo/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
    }

    location /apollo-permapol/ {
        proxy_pass http://apollo.bi.privat/apollo-permapol/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
    }

    location /apollo_api/ {
        proxy_pass http://apollo.bi.privat/apollo_api/;
        proxy_read_timeout 300;
    }

    location /beacon {
        rewrite ^/beacon/?(.*)$ /$1 break;
        proxy_pass http://beacon.galaxyproject.eu;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP       $remote_addr;
        proxy_set_header Host            beacon.galaxyproject.eu;
    }

    location /external/phdcomics/ {
        proxy_pass http://phdcomics.com/;
        # The comics are extremely cacheable. No sense waiting for a server from USA to respond.
        proxy_cache           STATIC;
        proxy_cache_valid     200  10d;
        proxy_cache_use_stale error timeout invalid_header updating http_500 http_502 http_503 http_504;
    }

    location /quota-increase {
        return 301 https://docs.google.com/forms/d/e/1FAIpQLSf9w2MOS6KOlu9XdhRSDqWnCDkzoVBqHJ3zH_My4p8D8ZgkIQ/viewform;
    }

    location /gpu-request {
        return 301 https://docs.google.com/forms/d/e/1FAIpQLSd-isWRKIX9QVRNJAEBVfh4pLpR3NsOAdOSgKpZH9sKdJ0rBg/viewform;
    }

    # TIaaS 2
    {{ tiaas_nginx_routes }}

    # For GTN in Galaxy Webhook
    location /training-material/ {
        proxy_ssl_server_name on;
        proxy_pass https://training.galaxyproject.org/training-material/;
    }

    location /request-tiaas {
        return 301 https://usegalaxy.eu/tiaas/new/;
    }

    location /freiburg {
        return 301 https://galaxyproject.eu/freiburg/;
    }
    location /erasmusmc {
        return 301 https://galaxyproject.eu/erasmusmc/;
    }
    location /pasteur {
        return 301 https://galaxyproject.eu/pasteur/;
    }
    location /belgium {
        return 301 https://galaxyproject.eu/belgium/;
    }
    location /people {
        return 301 https://galaxyproject.eu/people;
    }
    location /terms {
        return 301 https://galaxyproject.eu/gdpr;
    }

    location /favicon.ico {
        {{ upstream_galaxy() | indent(8, false) }}
        {{ upstream_galaxy_cache() | indent(8, false) }}
    }

    location /robots.txt {
        alias {{ galaxy_server_dir }}/static/robots.txt;
    }

    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;

    client_max_body_size 1G; # aka max upload size, defaults to 1M
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name humancellatlas.usegalaxy.eu;
    return 302 $scheme://singlecell.usegalaxy.eu$request_uri;
}


server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name microgalaxy.usegalaxy.eu microbiome.usegalaxy.eu metagenomics.usegalaxy.eu;
    return 302 $scheme://microbiology.usegalaxy.eu$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name graphclust.usegalaxy.eu clipseq.usegalaxy.eu;
    return 302 $scheme://rna.usegalaxy.eu$request_uri;
}