pid /run/nginx.pid;
{% if ansible_distribution_file_variety == "Debian" %}
user www-data;
{% if nginx_use_ppa or ansible_distribution_major_version >= '16' %}
worker_processes auto;
include /etc/nginx/modules-enabled/*.conf;

{% else %}
worker_processes {{ nginx_workers }};
{% endif %}
{% endif %}

{% if ansible_distribution_file_variety == "RedHat" %}
user nginx;
worker_processes auto;
# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;
{% endif %}

events {
    worker_connections {{ nginx_worker_connections }};
{% if nginx_use_epoll %}
    use epoll;
{% endif %}
    multi_accept {{ nginx_multi_accept }};
}
worker_rlimit_nofile    {{ nginx_worker_rlimit_nofile }};

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    log_format graylog_json escape=json '{'
#                      '"time_local":"$time_iso8601",'
#                      '"remote_addr":"$remote_addr",'
#                      '"remote_user":"$remote_user",'
#                      '"body_bytes_sent":"$body_bytes_sent",'
#                      '"request_time":"$request_time",'
#                      '"status":"$status",'
#                      '"request":"$request",'
#                      '"request_method":"$request_method",'
#                      '"http_referrer":"$http_referer",'
#                      '"http_user_agent":"$http_user_agent"'

        # Core & Time Metadata
        '"timestamp": "$time_iso8601", '
        '"connection_requests": $connection_requests, '
        
        # Client & Network Info
        '"remote_addr": "$remote_addr", '
        '"realip_remote_addr": "$realip_remote_addr", ' # Requires ngx_http_realip_module
        '"remote_user": "$remote_user", '
        '"http_x_forwarded_for": "$http_x_forwarded_for", '
        '"server_name": "$server_name", '
        '"port": "$server_port", '
        
        # Request Details
        '"request_method": "$request_method", '
        '"request_uri": "$request_uri", '
        '"uri": "$uri", '
        '"query_string": "$args", '
        '"server_protocol": "$server_protocol", '
        '"http_referrer": "$http_referer", '
        '"http_user_agent": "$http_user_agent", '
        
        # Security & SSL (Crucial for monitoring TLS versions)
        '"ssl_protocol": "$ssl_protocol", '
        '"ssl_cipher": "$ssl_cipher", '
        '"ssl_session_reused": "$ssl_session_reused", '
        
        # Performance & Compression Metrics
        '"status": $status, '
        '"body_bytes_sent": $body_bytes_sent, '
        '"bytes_sent": $bytes_sent, '
        '"request_length": $request_length, '
        '"gzip_ratio": "$gzip_ratio", ' # Will be a string or "-" if gzip is off
        
        # Detailed NGINX Timings (In seconds with millisecond precision)
        '"request_time": $request_time, '       # Total time spent on request
    #    '"ssl_handshake_time": "$ssl_handshake_time", ' # Requires NGINX 1.21.1+
        
        # Upstream (Backend Application) Performance
        '"upstream_addr": "$upstream_addr", '
        '"upstream_status": "$upstream_status", '
        '"upstream_response_time": "$upstream_response_time", '
        '"upstream_connect_time": "$upstream_connect_time", '
        '"upstream_header_time": "$upstream_header_time", '
        
        # Cache Status (If using NGINX proxy_cache)
        '"upstream_cache_status": "$upstream_cache_status", '
        
        # Custom Security Context (Optional headers to trace specific sessions)
        '"correlation_id": "$http_x_correlation_id", ' # Extracts custom tracing headers
        '"cookie_session_id": "$cookie_sessionid"'     # Extracts specific cookies
        '}';

    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout {{ nginx_keepalive_timeout }};
    send_timeout {{ nginx_send_timeout }};
    types_hash_max_size 2048;
    server_tokens {{ nginx_server_tokens }};
    server_names_hash_bucket_size {{ nginx_server_names_hash_bucket_size }};
    # server_name_in_redirect off;
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    client_header_buffer_size {{ nginx_client_header_buffer_size }};
    client_body_buffer_size {{ nginx_client_body_buffer_size }};
    large_client_header_buffers {{ nginx_large_client_header_buffers }};
    ##
    # Logging Settings
    ##
#    access_log /var/log/nginx/access.log;
#    error_log /var/log/nginx/error.log;
  access_log syslog:server=unix:/dev/log,facility=local7,tag=nginx,severity=info graylog_json;
  error_log syslog:server=unix:/dev/log,facility=local7,tag=nginx_error error;

  map_hash_bucket_size 128;
  map_hash_max_size 2048;

{% if nginx_enable_compression %}
    include /etc/nginx/snippets/nginx-compression.conf;
{% endif %}
{% if nginx_websockets_support %}
    include /etc/nginx/snippets/nginx-websockets.conf;
{% endif %}
    include /etc/nginx/conf.d/*.conf;

{% if ansible_distribution_file_variety == "RedHat" %}
    # Load configuration files for the default server block.
    # include /etc/nginx/default.d/*.conf;
{% endif %}
{% if ansible_distribution_file_variety == "Debian" %}
    include /etc/nginx/sites-enabled/*;
{% endif %}
}
{% if nginx_streams is not none %}
# Load streams configurations
stream {
  include /etc/nginx/stream.d/*.conf;
}
{% endif %}