;;; Tyreunom's system administration and configuration tools.

;;;

;;; Copyright ?? 2019 Julien Lepiller <julien@lepiller.eu>

;;;

;;; This program is free software: you can redistribute it and/or modify

;;; it under the terms of the GNU General Public License as published by

;;; the Free Software Foundation, either version 3 of the License, or

;;; (at your option) any later version.

;;;

;;; This program is distributed in the hope that it will be useful,

;;; but WITHOUT ANY WARRANTY; without even the implied warranty of

;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

;;; GNU General Public License for more details.

;;;

;;; You should have received a copy of the GNU General Public License

;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(define-module (config web)

  #:export (web-base-policy

            web-html-policy

	    default-web-policy))

(define web-base-policy

  '("add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"

    "add_header X-Frame-Options DENY;"

    "add_header X-Content-Type-Options nosniff;"

    "add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"

    "add_header Referrer-Policy no-referrer;"))

(define (web-html-policy additional-data)

  (append

    '("location ~ \\.html$ {"

      "    add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';"

      "    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"

      "    add_header X-Frame-Options DENY;"

      "    add_header X-Content-Type-Options nosniff;"

      "    add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"

      "    add_header Referrer-Policy no-referrer;")

    additional-data

    '("    expires off;"

      "}")))

(define default-web-policy

  (append

    web-base-policy

    (web-html-policy '())))

(use-modules (config certbot) (config dns) (config mail) (config network) (config os)

	     (config web))

(define lepiller-policy

  (append

    web-base-policy

    '("set $first_language $http_accept_language;"

      "if ($http_accept_language ~* '(en|eo|fr)') {"

      "    set $first_language $1;"

      "}"

      "set $language_suffix $first_language;"

      "if ($cookie_language) {"

      "    set $language_suffix $cookie_language;"

      "}"

      "if ($uri ~ \\.en.html$) {"

      "    set $language_suffix 'en';"

      "}"

      "if ($uri ~ \\.eo.html$) {"

      "    set $language_suffix 'eo';"

      "}"

      "if ($uri ~ \\.fr.html$) {"

      "    set $language_suffix 'fr';"

      "}"

      "if ($uri ~ (.*).html) {"

      "    set $my_uri $1.$language_suffix.html;"

      "}")

    (web-html-policy

      '("    add_header Set-Cookie 'language=$language_suffix;HttpOnly;Secure';"

        "    try_files $my_uri $uri $uri/ =404;"))

    '("error_page 404 /404;")))

                  (raw-content lepiller-policy))))

                  (server-name '(default))

		  (root "/srv/http/default")

		  (raw-content default-web-policy)))))