;;; Tyreunom's system administration and configuration tools.
;;;
;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
;;;
;;; This program is free software: you can redistribute it and/or modify
;;; it under the terms of the GNU General Public License as published by
;;; the Free Software Foundation, either version 3 of the License, or
;;; (at your option) any later version.
;;;
;;; This program is distributed in the hope that it will be useful,
;;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

(define-module (config web)
  #:export (web-base-policy
            web-html-policy
	    default-web-policy
        accept-languages))

(define (accept-languages language-lists)
  "Returns nginx configuration code to set up the $lang variable
according to the Accept-Language header in the HTTP request.  The
requesting user agent will be served the files at /$lang/some/url.
Each list in LANGUAGE-LISTS starts with the $lang and is followed by
synonymous IETF language tags that should be mapped to the same $lang."
  (define (language-mappings language-list)
    (define (language-mapping language)
      (string-join (list "    "  language (car language-list) ";")))
    (string-join (map language-mapping language-list) "\n"))

  (let ((directives
         `(,(string-join
             `("set_from_accept_language $lang_unmapped"
               ,@(map string-join language-lists)
               ";"))
           "map $lang_unmapped $lang {"
           ,@(map language-mappings language-lists)
           "}")))
    directives))

(define web-base-policy
  '("add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"
    "add_header X-Frame-Options DENY;"
    "add_header X-Content-Type-Options nosniff;"
    "add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
    "add_header Referrer-Policy no-referrer;"))

(define (web-html-policy additional-data)
  (append
    '("location ~ \\.html$ {"
      "    add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';"
      "    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;"
      "    add_header X-Frame-Options DENY;"
      "    add_header X-Content-Type-Options nosniff;"
      "    add_header Content-Security-Policy 'default-src \\'none\\'; img-src \\'self\\'; style-src \\'self\\' \\'unsafe-inline\\'; frame-ancestors \\'none\\'';"
      "    add_header Referrer-Policy no-referrer;")
    additional-data
    '("    expires off;"
      "}")))

(define default-web-policy
  (append
    web-base-policy
    (web-html-policy '())))