# web管理控制台
upstream nexus_web {
    server localhost:8081;
}

# docker-group聚合仓库
upstream nexus_docker_get {
    server localhost:8003;
}

# docker-hosted本地仓库
upstream nexus_docker_put {
    server localhost:8002;

}

# HTTP 自动跳转 HTTPS
server {
    listen 80;
    # 设置docker代理使用的域名，你可以将 docker-registry.hellogitlab.com 替换成你的域名
    server_name docker-registry.hellogitlab.com;
    rewrite ^ https://$http_host$request_uri? permanent;
}

server {
    # 由于上面设置了HTTP 自动跳转 HTTPS，此处注释掉80端口
    # listen 80;
    listen 443 ssl;
    # 设置docker代理使用的域名，你可以将 docker-registry.hellogitlab.com 替换成你的域名
    server_name docker-registry.hellogitlab.com;
    # 设置日志文件，对应的日志格式使用main
    # main日志格式，在nginx.conf中log_format  main行定义过
    access_log /var/log/nginx/docker-registry.hellogitlab.com.log main;
    # 证书
    ssl_certificate     /etc/pki/nginx/docker-registry.hellogitlab.com_bundle.crt;
    ssl_certificate_key /etc/pki/nginx/docker-registry.hellogitlab.com.key;
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;

    # disable any limits to avoid HTTP 413 for large image uploads
    client_max_body_size 0;
    # required to avoid HTTP 411: see Issue #1486 (https://github.com/docker/docker/issues/1486)
    chunked_transfer_encoding on;

    # 请求逻辑调整
    # 设置默认使用docker-group聚合仓库，即拉取镜像的情况多些
    set $upstream "nexus_docker_get";
    # 当请求是 PUT，也就是推送镜像的时候，如此便解决了拉取和推送的端口统一
    if ( $request_method ~* 'PUT') {
        set $upstream "nexus_docker_put";
    }
    # 我测试的时候，docker-hosted本地仓库和docker-proxy代理仓库都支持搜索，所以将下面这段逻辑调整注释掉
    # 只有本地仓库才支持搜索，所以将搜索请求转发到本地仓库，否则出现 500 报错
    # if ($request_uri ~ '/search') {
    #    set $upstream "nexus_docker_put"; 
    # }

    index index.html index.htm index.php;
    location / {
        proxy_pass http://$upstream;
        proxy_set_header Host $host;
        proxy_connect_timeout 3600;
        proxy_send_timeout 3600;
        proxy_read_timeout 3600;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_buffering off;
        proxy_request_buffering off;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # 直接使用以下配置【proxy_set_header X-Forwarded-Proto http; 】时，
        # 在尝试向仓库中push推送镜像时，就是docker login登陆成功了也会报以下认证异常
        # unauthorized: access to the requested resource is not authorized
        # proxy_set_header X-Forwarded-Proto http;
        # 修复docker push认证异常问题，将http替换成https即可
        proxy_set_header X-Forwarded-Proto https;
    }
}

# HTTP 自动跳转 HTTPS
server {
    listen 80;
    # 设置Nexus web管理控制台使用的域名，你可以将 nexus.hellogitlab.com 替换成你的域名
    server_name nexus.hellogitlab.com;
    rewrite ^ https://$http_host$request_uri? permanent;
}

server {
    # 由于上面设置了HTTP 自动跳转 HTTPS，此处注释掉80端口
    # listen 80;
    listen 443 ssl;
    # 设置Nexus web管理控制台使用的域名，你可以将 nexus.hellogitlab.com 替换成你的域名
    server_name nexus.hellogitlab.com;
    index index.html index.htm index.php;
    # 证书
    ssl_certificate     /etc/pki/nginx/nexus.hellogitlab.com_bundle.crt;
    ssl_certificate_key /etc/pki/nginx/nexus.hellogitlab.com.key;
    ssl_protocols TLSv1.1 TLSv1.2;
    ssl_ciphers '!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES:';
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    # 设置日志文件，对应的日志格式使用main
    # main日志格式，在nginx.conf中log_format  main行定义过
    access_log /var/log/nginx/nexus.hellogitlab.com.log main;
    location / {
        proxy_pass http://nexus_web;
        proxy_set_header Host $host;
        client_max_body_size 512m;
        proxy_connect_timeout 3600;
        proxy_send_timeout 3600;
        proxy_read_timeout 3600;
        proxy_buffering off;
        proxy_request_buffering off;
    }
}