---
# Nginx reverse proxy for Matrix + Element

- name: Create certbot webroot
  file:
    path: /var/www/certbot
    state: directory
    owner: www-data
    group: www-data
    mode: "0755"

- name: Deploy HTTP-only nginx config (for certbot)
  copy:
    dest: /etc/nginx/sites-available/matrix
    content: |
      server {
          listen 80;
          server_name {{ matrix_domain }};
          location /.well-known/acme-challenge/ { root /var/www/certbot; }
          location / { return 200 'phantom setup in progress'; add_header Content-Type text/plain; }
      }
    mode: "0644"
  notify: reload nginx

- name: Enable Matrix nginx site
  file:
    src: /etc/nginx/sites-available/matrix
    dest: /etc/nginx/sites-enabled/matrix
    state: link
  notify: reload nginx

- name: Flush handlers to apply HTTP config
  meta: flush_handlers

- name: Setup TLS (certbot with self-signed fallback)
  include_tasks: ../../common/tls_setup.yml
  vars:
    _tls_domain: "{{ matrix_domain }}"

- name: Disable server tokens in nginx
  lineinfile:
    path: /etc/nginx/nginx.conf
    regexp: "^\\s*#?\\s*server_tokens"
    line: "\tserver_tokens off;"
    insertafter: "sendfile on;"
  notify: reload nginx

- name: Remove default nginx site
  file:
    path: /etc/nginx/sites-enabled/default
    state: absent
  notify: reload nginx

- name: Deploy hardened SSL nginx config
  copy:
    dest: /etc/nginx/sites-available/matrix
    content: |
      # Rate limiting zones
      limit_req_zone $binary_remote_addr zone=matrix_login:10m rate=3r/m;
      limit_req_zone $binary_remote_addr zone=matrix_general:10m rate=10r/s;

      server {
          listen 80;
          server_name {{ matrix_domain }};
          location /.well-known/acme-challenge/ { root /var/www/certbot; }
          location / { return 301 https://$host$request_uri; }
      }

      server {
          listen 443 ssl http2;
          listen 8448 ssl http2;
          server_name {{ matrix_domain }};

          # TLS
          ssl_certificate {{ _ssl_cert }};
          ssl_certificate_key {{ _ssl_key }};
          ssl_protocols TLSv1.2 TLSv1.3;
          ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
          ssl_prefer_server_ciphers off;
          ssl_session_timeout 1d;
          ssl_session_cache shared:SSL:10m;
          ssl_session_tickets off;

          # Security headers
          {% if _is_selfsigned | default(false) | bool %}
          add_header Strict-Transport-Security "max-age=0" always;
          {% else %}
          add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
          {% endif %}
          add_header X-Frame-Options "SAMEORIGIN" always;
          add_header X-Content-Type-Options "nosniff" always;
          add_header X-XSS-Protection "1; mode=block" always;
          add_header Referrer-Policy "strict-origin-when-cross-origin" always;
          add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

          client_max_body_size 50m;

          # Block Synapse admin API from external access
          location /_synapse/admin {
              return 403;
          }

          # Login endpoint — strict rate limit
          location /_matrix/client/v3/login {
              limit_req zone=matrix_login burst=3 nodelay;
              proxy_pass http://127.0.0.1:8008;
              proxy_set_header X-Forwarded-For $remote_addr;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header Host $host;
          }

          # Matrix client + federation API
          location ~* ^(\/_matrix|\/_synapse\/client) {
              limit_req zone=matrix_general burst=20 nodelay;
              proxy_pass http://127.0.0.1:8008;
              proxy_set_header X-Forwarded-For $remote_addr;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header Host $host;
              proxy_read_timeout 600s;
              proxy_send_timeout 600s;
          }

          location /.well-known/matrix/server {
              return 200 '{"m.server": "{{ matrix_domain }}:443"}';
              add_header Content-Type application/json;
          }

          location /.well-known/matrix/client {
              return 200 '{"m.homeserver": {"base_url": "https://{{ matrix_domain }}"}}';
              add_header Content-Type application/json;
              add_header Access-Control-Allow-Origin *;
          }

          # Element Web
          location / {
              root /var/www/element;
              try_files $uri $uri/ /index.html;
              add_header Content-Security-Policy "frame-ancestors 'self'" always;
          }
      }
    mode: "0644"
  notify: reload nginx