[uwsgi]
master          = true
plugins         = cgi
socket          = /run/uwsgi/%n.sock
uid             = nginx
gid             = nginx
procname-master = uwsgi csvn
processes       = 1
threads         = 2
cgi             = /var/www/htdocs/csvn/csvn.cgi

#!/bin/sh
#
# uWSGI daemon control script.
#
CONF=csvn
BIN=/usr/bin/uwsgi
CONFDIR=/etc/uwsgi
PID=/var/run/$CONF-uwsgi.pid
uwsgi_start() {
  # Sanity checks.
  if [ ! -r $CONFDIR/csvn.ini ]; then # no config files, exit:
    echo "There are config files in $CONFDIR directory. Abort."
    exit 1
  fi
  if [ -s $PID ]; then
    echo "uWSGI for cSvn appears to already be running?"
    exit 1
  fi
  echo "Starting uWSGI for cSvn server daemon..."
  if [ -x $BIN ]; then
    /bin/mkdir -p /run/uwsgi
    /bin/chown nginx:nginx /run/uwsgi
    /bin/chmod 0755 /run/uwsgi
    $BIN --thunder-lock --pidfile $PID --daemonize /var/log/csvn-uwsgi.log --ini $CONFDIR/$CONF.ini
  fi
}
uwsgi_stop() {
  echo "Shutdown uWSGI for cSvn gracefully..."
  /bin/kill -INT $(cat $PID)
  /bin/rm -f $PID
}
uwsgi_reload() {
  echo "Reloading uWSGI for cSvn configuration..."
  kill -HUP $(cat $PID)
}
uwsgi_restart() {
  uwsgi_stop
  sleep 3
  uwsgi_start
}
case "$1" in
  start)
    uwsgi_start
    ;;
  stop)
    uwsgi_stop
    ;;
  reload)
    uwsgi_reload
    ;;
  restart)
    uwsgi_restart
    ;;
  *)
  echo "usage: `basename $0` {start|stop|reload|restart}"
esac

chmod a+x /ets/rc.d/rc.csvn-uwsgi

# Start uWSGI for cSvn server:
if [ -x /etc/rc.d/rc.csvn-uwsgi ]; then
  /etc/rc.d/rc.csvn-uwsgi start
fi

# Stop uWSGI for cSvn server:
if [ -x /etc/rc.d/rc.csvn-uwsgi ]; then
  /etc/rc.d/rc.csvn-uwsgi stop
fi

#
# cSvn server:
#
    server {
        listen 80;
        server_name csvn.example.org;
        return 301 https://csvn.example.org$request_uri;
    }
    server {
        listen 443 ssl;
        server_name csvn.example.org;
        root /var/www/htdocs/csvn;
        charset UTF-8;
        #
        # see:
        #   https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security ,
        #   https://raymii.org/s/tutorials/HTTP_Strict_Transport_Security_for_Apache_NGINX_and_Lighttpd.html
        #
        # see also: http://classically.me/blogs/how-clear-hsts-settings-major-browsers
        # and do not include includeSubdomains; parameter into line:
        #
        add_header Strict-Transport-Security "max-age=63072000; preload";
        error_log /var/log/nginx/csvn.example.org-error.log;
        access_log /var/log/nginx/csvn.example.org-access.log;
        keepalive_timeout        60;
        ssl_certificate          /etc/letsencrypt/live/csvn.example.org/fullchain.pem;
        ssl_certificate_key      /etc/letsencrypt/live/csvn.example.org/privkey.pem;
        ssl_trusted_certificate  /etc/letsencrypt/live/csvn.example.org/chain.pem;
        ssl_protocols            SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers              "RC4:HIGH:!aNULL:!MD5:!kEDH";
        gzip on;
        gzip_disable "msie6";
        gzip_comp_level 6;
        gzip_min_length 1100;
        gzip_buffers 16 8k;
        gzip_proxied any;
        gzip_types text/plain text/css text/js text/xml text/javascript
                   image/svg+xml image/gif image/jpeg image/png
                   application/json application/x-javascript application/xml application/xml+rss application/javascript
                   font/truetype font/opentype application/font-woff application/font-woff2
                   application/x-font-ttf application/x-font-opentype application/vnd.ms-fontobject application/font-sfnt;
        #
        # Serve static content with nginx
        #
        #
        # Rewrite rules for versioning CSS + JS thtouh filemtime directive
        #
        location ~* ^.+.(css|js)$ {
            rewrite ^(.+).(d+).(css|js)$ $1.$3 last;
            expires 31536000s;
            access_log off;
            log_not_found off;
            add_header Pragma public;
            add_header Cache-Control "max-age=31536000, public";
        }
        #
        # Caching of static files
        #
        location ~* .(eot|gif|gz|gzip|ico|jpg|jpeg|otf|pdf|png|svg|svgz|swf|tar|t?gz|woff|zip)$ {
            expires 31536000s;
            access_log off;
            log_not_found off;
            add_header Pragma public;
            add_header Cache-Control "max-age=31536000, public";
        }
        location ~ ^/favicon.ico$ {
            root /u3/nginx/vhosts/csvn;
            access_log off;
            log_not_found off;
            expires 30d;
        }
        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }
        location / {
            try_files $uri @csvn;
        }
        location @csvn {
            gzip off;
            include uwsgi_params;
            uwsgi_modifier1 9;
            uwsgi_pass unix:/run/uwsgi/csvn.sock;
        }
    }

include /etc/nginx/vhosts/csvn.example.org.conf;