user             apache; worker_processes 32;
error_log        /var/log/httpd/nginx.error.log crit;
pid              /var/run/nginx.pid;

worker_rlimit_nofile 32000;

events {
  worker_connections 4096;
}

http {
  include      /etc/nginx/mime.types;
  default_type application/octet-stream;
  gzip on;
  gzip_comp_level 6;
  gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

  sendfile             on;
  keepalive_timeout    0;
  client_max_body_size 500M;
  proxy_buffering off;

  resolver 208.94.0.30;

  set_real_ip_from 208.94.0.0/22;
  set_real_ip_from 38.99.76.0/22;
  set_real_ip_from 127.0.0.1;
  real_ip_header   X-Forwarded-For;


# -r12801 stuff
# Not sure what these were but reverting them because they were not pushed.
# -jmarch
#
#-    '"$http_user_agent" "{\x22t\x22:\x22$request_time\x22,\x22c\x22:\x22'
#+    '"$http_user_agent" "{\x22t\x22:$request_time,\x22c\x22:\x22'
#     '$cookie_is_uuid\x22,\x22s\x22:\x22$upstream_http_x_imageshack_sid\x22,'
#-    '\x22H\x22:\x22$http_host\x22,\x22b\x22:\x22$http_content_length\x22}"';
#+    '\x22H\x22:\x22$http_host\x22}"';


  log_format main '$remote_addr - $remote_user [$time_local] '
    '"$request" $body_bytes_sent $status "$http_referer" '
    '"$http_user_agent" "{\x22t\x22:$request_time,\x22c\x22:\x22'
    '$cookie_is_uuid\x22,\x22s\x22:\x22$upstream_http_x_imageshack_sid\x22,'
    '\x22H\x22:\x22$http_host\x22}"';


  access_log /var/log/httpd/imageshack.us main;
  error_log  /var/log/httpd/nginx.error.log;

  log_format post '$remote_addr |  [$time_local] | $http_host | $request ' 
                  '| $http_content_length | $request_time | $status';
  upstream upload_servers {
    server 208.94.0.61;
    server 208.94.0.38;
  }

  index index.php index.html index.htm;

  uuid         on;
  uuid_path    /;
  uuid_name    is_uuid;
  uuid_domain  .imageshack.us;
  uuid_expires max;
  uuid_p3p     'CP="NOI CUR ADM OUR NOR STA NID"';

  # --- DEFAULT BLOCK ---
  server {
    listen      127.0.0.1:816;
    listen      127.0.0.1:14000;
    server_name _;
    # error_page 403 http://www.imageshack.us/403.php;
    proxy_intercept_errors on;
    error_page 403 = @403_handler;
    include /etc/nginx/invalid_referers.conf;

    root /home/image/www;
    error_page 504 = @sniffer;
    error_page 500 = @snifferv2;
    error_page 404 = @snifferv3;

    # temp hack to send 403's to localhost
    location @403_handler {
      root /home/image/www;
      include       /etc/nginx/fastcgi_params;
      fastcgi_param  X_ORIGINAL_URL $request_uri;
      # rewrite ^.*$ /403.php last;
      fastcgi_param  SCRIPT_NAME        /403.php;
      fastcgi_param  DOCUMENT_URI       /403.php;
      fastcgi_param  SCRIPT_NAME        /403.php;
      fastcgi_param SCRIPT_FILENAME /home/image/www/403.php;
      fastcgi_pass  unix:/tmp/php.sock;
    }

    rewrite ^/protected_files/(.*) /$1 last;

    location /FEupload_api {
      internal;
      access_log /var/log/httpd/http.post.log post;
      proxy_set_header  Host retinat.imageshack.us;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_pass  http://upload_servers$request_uri;
    }

    location @sniffer {
      expires -1;
      proxy_intercept_errors off;
      proxy_set_header  Host $http_host;

      # we handle corner cases like no other
       if ($request_uri ~ ^/i/.*$) {
        proxy_pass  http://stream.imageshack.us/redirect.php?goto=$request_uri;
       }
      # Do we need ? return 504;
    }

    location @snifferv2 {
      expires -1;
      proxy_intercept_errors off;
      proxy_set_header  Host $http_host;
      proxy_pass  http://stream.imageshack.us/500.php?goto=$request_uri;

    }

    location @snifferv3 {
      expires -1;
      proxy_intercept_errors off;
      proxy_set_header  Host $http_host;
      if ($request_uri ~ ^/(img[0-9]+)/([0-9]+)/([0-9a-zA-Z-_]+\.[a-zA-Z]+)$) {
          proxy_pass http://$1.imageshack.us/restore_image.php?server=$1&bucket=$2&filename=$3;
          break;
      }
          return 404;
    }

    # global headers
    add_header X-Server-Name-And-Port $server_name:$server_port;

    # global health check
    location /healthz { return 204; }

    location /hotness {
      
      if ( -f /dev/shm/hotness$request_uri ) { 
        rewrite ^.*$ /ishotness last;
        break;
      }
      proxy_pass http://127.0.0.1:15000$request_uri;
      
    }
    location /ishotness {
      # proxy_set_header  Host thermos.imageshack.us;
      # proxy_pass http://208.94.2.199:12005$request_uri;
      # proxy_pass http://208.94.2.199:12005$request_uri;
      rewrite ^.*$ http://208.94.2.199$request_uri;
    }

    location ~ ^/.+\.ban$ {
      valid_referers none blocked
        imageshack.us *.imageshack.us
        imageshack.com *.imageshack.com
        yfrog.us *.yfrog.us
        yfrog.com *.yfrog.com;

      if ($invalid_referer) {
        return 403;
      }
    }

    location / {
      log_not_found  off;
      if ($http_referer ~* 
   # http://www.google.com/m/search
        ^(.+google.com/search\?tbm|.+/m/search|.+/imgres|http://www\.bing\.com/images/search)) {
        rewrite ^/img(\d+)/(\d+)/(.+)$ 
          /handle_direct.php?f=$3&b=$2&s=$1&action=rd last;
        break;

      }

      # atmosphere static caching load test haproxy flow
      if ($uri ~ ^/+img[0-9]+/[0-9]+/\w+[.]\w+$) {
        # rewrite ^.*$ /hotness last;
        # break;
        proxy_pass http://127.0.0.1:14080;
      }

      # crackle redirector
      #if ($uri ~ ^/+(images|scripts)/.*$) {
      #  rewrite ^(.*)$ http://crackle.imageshack.us$1 permanent;
      #  break;
      #}
    }

    location /partner {
      uuid off;
    }

    if ($request_uri ~ ^/photos/[^/]+$) {
      rewrite ^/photos/([^/]+)$ /find/index.php?q=$1;
      break;
    }
    if ($request_uri ~ ^/photos/[^/]+/[^/]+$) {
      rewrite ^/photos/([^/]+)/([^/]+)$ /find/index.php?page=$1&q=$2;
      break;
    }
    if ($request_uri ~ ^/photos/[^/]+/[^/]+/[^/]+$) {
      rewrite ^/photos/([^/]+)/([^/]+)/([^/]+)$ /find/index.php?page=$1&cat=$2&kw=$3;
      break;
    }

    location ^~ /photos/ {
      rewrite ^/photos/(.*)/([0-9]+)/(.*)/(.*)$ /my.php?kwd=$1&srv=$2&image=$3&via=blue&$4 last;
      rewrite ^/photos/(.*)/(.*)/(.*)$ http://$host/photos/$1/$2/$3/ permanent;
      break;
    }

    location ^~ /photo/ {
      rewrite ^/photo/(.*)/([0-9]+)/(.*)/(.*)$ /my.php?kwd=$1&srv=$2&image=$3&via=blue&ftype=photo&$4 last;
      rewrite ^/photo/(.*)/(.*)/(.*)$ http://$host/photo/$1/$2/$3/ permanent;
      break;
    }

    location ^~ /clip/ {
      rewrite ^/clip/(.*)/([0-9]+)/(.*)/(.*)$ /my.php?kwd=$1&srv=$2&image=$3&via=blue&ftype=clip&$4 last;
      rewrite ^/clip/(.*)/(.*)/(.*)$ http://$host/clip/$1/$2/$3/ permanent;
      break;
    }

    # dont enforce an 8 second timeout on our normal POST locations
    location ~* (transload|gallery_api|pictures|upload_api|index)\.php$ {

      #send upload_api off to be proxied to FE
      # if ($request_method = POST ) {
        # rewrite ^/+index\.php$ /FEupload_api;
        # rewrite ^/+upload_api\.php$ /FEupload_api;
      # }

      
      proxy_hide_header X-IMAGESHACK-SID;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  Host $http_host;
      proxy_set_header  X-Original-To $http_x_original_to;
      proxy_pass        http://127.0.0.1:8001;
    }

    location ~ \.php$ {
      proxy_read_timeout 60;
      proxy_hide_header X-IMAGESHACK-SID;
      proxy_set_header X-Forwarded-For $remote_addr;
      proxy_set_header  Host $http_host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_pass        http://127.0.0.1:8001;

      if ($uri ~ ^/img[0-9]+/[0-9]+) {
        return 403;
      }
    }

    location /nginx_status {
      stub_status on;
      access_log  off;

      allow 10.9.0.0/24;
      allow 38.99.76.207;
      allow 127.0.0.1;
      deny  all;
    }

    # health checks for local nginx instance
    location /health {
      access_log off;

      # just in case a roxy health check falls through
      if ($uri ~ ^/health/img\.ngx$) {
        return 204;
      }

      if ($uri ~ ^/health/atm/local_or_meso$) {
        return 204;
      }

      return 501;
    }

    # Blocked Extensions
    location ~* \.(inc|cfg|ip|tar|gz|props\.xml)$ {
      deny  all;
    }


    ############
    # Rewrites #
    ############

    # Landing Page
    location ^~ /i/ {
      rewrite ^/i/(.*)/(.*)$ /my.php?image=$1&via=blue&$2 last;
      rewrite ^/i/(.*)$ http://$host/i/$1/ permanent;
      break;
    }

    # SEO landing page url rewrite for Jack
    location ^~ /f/ {
      rewrite ^/f/(.+[a-zA-Z0-9]).* /fullimg.php?f=$1 last;
      break;
    }

    # Gallery Pages
    location ^~ /g/ {
      rewrite ^/g/(.*)/(.*)$ /gal.php?g=$1&$2 last;
      rewrite ^/g/(.*)$ http://$host/g/$1/ permanent;
      break;
    }

    location ^~ /user/ {
      rewrite ^/user/([A-Za-z0-9\_]+)$ 
        http://profile.imageshack.us/homepage/?user=$1"  permanent;
      break;
    }

    # Remote Javascript include for Jack test
    location ^~ /si/ {
      rewrite ^/si/([^\?/]+)(/\?*(.*)) /si.php?img=$1&$3" last;
      break;
    }

    # Off-Site Ad System.  Eg:
    # img245.yfrog.com:8000/img245/6parvathiomanakuttanpic.jpg/1/w267.png
    location ~ /img([0-9]+)/([A-Za-z0-9_\.]+)/([0-9]+)/w([0-9]+)\.png$ {
      rewrite ^/img([0-9]+)/([A-Za-z0-9_\.]+)/([0-9]+)/w([0-9]+)\.png$
        /dynamic-ad1.php?h=$1&f=$2&w=$4 last;
      break;
    }

    # Tor
    # location ^~ /tor/browse/ 
    location /tor {
      set  $tor_uri $request_uri;
      if ($uri ~  ^/tor/browse/([0-9]+)/(.*)$) {
      # rewrite ^/tor/browse/([0-9]+)/(.*)$ /tor/browse/?id=$1&rel=$2 last;
        set $tor_uri  /tor/browse/?id=$1&rel=$2;
      }
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  X-Original-To $http_x_original_to;
      proxy_pass        http://127.0.0.1:8001$tor_uri;
    }

    if ($request_uri ~ ^/p/.+) {
      rewrite ^/p/(.+)/ /content.php?page=$1;
      rewrite ^/p/(.+) /content.php?page=$1;
      break;
    }

    if ($request_uri ~ ^/s/[^/]+$) {
      rewrite ^/s/([^/]+)$ /find/index.php?q=$1;
      break;
    }

    if ($request_uri ~ ^/s/[^/]+/[^/]+$) {
      rewrite ^/s/([^/]+)/([^/]+)$ /find/index.php?cat=$1&kw=$2;
      break;
    }
  }
  

  # --- PHP BLOCK ---
  server {
    # This block is for handling PHP requests, this could be an entirely
    # different httpd running it's own directives in http {} or perhaps
    # an entirely different webserver.
    uuid off;

    listen         *:8001;
    server_name    *.imageshack.us;
    error_page 502 = @sniffer;
    proxy_intercept_errors on;
    include /etc/nginx/invalid_referers.conf;

    root /home/image/www;

    set_real_ip_from 208.94.0.0/22;
    set_real_ip_from 38.99.76.0/22;
    set_real_ip_from 127.0.0.1;
    real_ip_header   X-Forwarded-For;
 

    access_log off;
    # error_log /var/log/nginx/php-error.log;

    location @sniffer {
      proxy_intercept_errors off;
      proxy_set_header  Host $http_host;
      proxy_pass  http://208.94.1.32:8080;

    }

    location ~ \.php$ {
      include       /etc/nginx/fastcgi_params;
      fastcgi_param  X_ORIGINAL_TO $http_x_original_to;
      fastcgi_pass  unix:/tmp/php.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME /home/image/www$fastcgi_script_name;
    }

    location /tor {
      include       /etc/nginx/fastcgi_params;
      fastcgi_param REMOTE_ADDR $http_x_forwarded_for;
      fastcgi_param  X_ORIGINAL_TO $http_x_original_to;
      fastcgi_pass  unix:/tmp/php.sock;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME /home/image/www$fastcgi_script_name;

    }

    location /download {
      internal;
      root /usr/local/tor;
    }
    location /torsendfile {
      internal;
      # rewrite ^/(torsendfile)(.*)$ /download$2;
      if ($uri ~ ^/torsendfile(.*)$) {
        set $torfile $1;
      }
      proxy_pass http://127.0.0.1:14080/download$torfile;
    }
  }

  # Static-only listen stanza
  server {
    # this port is reached via local haproxy and direcly from meso tier
    uuid       off;
    listen     *:14080;
    access_log off;

    root /home/image/www;

    # global headers
    add_header X-Server-Name-And-Port $server_name:$server_port;

    # global health check
    location /healthz { return 204; }

    # try local
    location / {
    }

    location /download {
      root /usr/local/tor;
    }
  }
  server {
    # this port is reached via local haproxy and direcly from meso tier
    uuid       off;
    listen     *:15080;
    access_log /var/log/httpd/private_img_access.log;

    root /home/image/private;

    # global headers
    add_header X-Server-Name-And-Port $server_name:$server_port;

    # global health check
    location /healthz { return 204; }

    # try local
    location / {
    }
  }



}
