server {
    listen 58881 default_server;
    server_name localhost _;
    root /usr/share/nginx/html;
    index background.html;

    location / {
        add_header Cache-Control "no-store, must-revalidate" always;
        try_files $uri $uri/ =404;
    }

    # Page, config and scripts must never come out of a stale browser
    # cache: without this a changed CONFIG (new location, layer toggles)
    # keeps rendering the previous setup until a hard reload.
    location ~* \.(js|html)$ {
        add_header Cache-Control "no-store, must-revalidate" always;
    }

    # The background page runs as an iframe on other origins; a stray
    # favicon request must not log 404s.
    location = /favicon.ico {
        return 204;
        access_log off;
    }

    # CORS proxies for the two basemap styles the scene can use.
    # /esri/streets/{z}/{y}/{x}.jpg  -> ESRI World_Street_Map (place names)
    # /esri/imagery/{z}/{y}/{x}.jpg  -> ESRI World_Imagery (aerial)
    location ^~ /esri/ {
        resolver 1.1.1.1 8.8.8.8 ipv6=off valid=300s;
        rewrite ^/esri/streets/(.*)$ /ArcGIS/rest/services/World_Street_Map/MapServer/tile/$1 break;
        rewrite ^/esri/imagery/(.*)$ /ArcGIS/rest/services/World_Imagery/MapServer/tile/$1 break;
        proxy_pass https://server.arcgisonline.com;
        proxy_ssl_server_name on;
        proxy_set_header Host server.arcgisonline.com;
        proxy_set_header User-Agent "Mozilla/5.0 (compatible; tile-proxy)";
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
        add_header Access-Control-Max-Age 86400 always;
    }

    # CORS proxy for Mapzen/TILEZEN terrain-RGB "terrarium" elevation
    # tiles (Copernicus DEM). URL format: /terrarium/{z}/{x}/{y}.png
    location ^~ /terrarium/ {
        resolver 1.1.1.1 8.8.8.8 ipv6=off valid=300s;
        proxy_pass https://s3.amazonaws.com/elevation-tiles-prod/terrarium/;
        proxy_ssl_server_name on;
        proxy_set_header Host s3.amazonaws.com;
        proxy_set_header User-Agent "Mozilla/5.0 (compatible; tile-proxy)";
        add_header Access-Control-Allow-Origin "*" always;
    }

    # CORS proxy for Overpass (road, place and airport queries). The public
    # mirrors answer cross-origin POSTs without Access-Control-Allow-Origin
    # (or refuse outright), so the app talks to same-origin paths here and
    # nginx forwards with a browser-like request. Overpass timeouts are long:
    # a busy instance needs more than the default 60 s.
    # URL format: /overpass/<mirror>/interpreter   (mirror: api | coffee | mail)
    location ^~ /overpass/api/ {
        # Host in a variable so the resolver directive applies: with a literal
        # host nginx resolves at config time and tried AAAA records, which the
        # container cannot reach (101 Network unreachable) and which then
        # disabled the upstream for a while.
        resolver 1.1.1.1 8.8.8.8 ipv6=off valid=300s;
        set $overpass_api_host "overpass-api.de";
        proxy_pass https://$overpass_api_host/api/;
        proxy_ssl_server_name on;
        proxy_set_header Host overpass-api.de;
        proxy_set_header Origin "https://overpass-api.de";
        proxy_set_header Referer "https://overpass-api.de/api/interpreter";
        proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";
        proxy_connect_timeout 15s; proxy_send_timeout 120s; proxy_read_timeout 120s;
        # A cell that answered once is kept for 30 days and served even while
        # the mirror is down (stale), so a flaky instance cannot undo progress
        # the browser already paid for.
        proxy_cache overpass;
        proxy_cache_key "$scheme$host$request_uri$request_body";
        proxy_cache_methods POST;
        proxy_cache_valid 200 30d;
        proxy_cache_lock on;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        add_header X-Cache $upstream_cache_status always;
        add_header Access-Control-Allow-Origin "*" always;
    }
    location ^~ /overpass/coffee/ {
        resolver 1.1.1.1 8.8.8.8 ipv6=off valid=300s;
        set $overpass_coffee_host "overpass.private.coffee";
        proxy_pass https://$overpass_coffee_host/api/;
        proxy_ssl_server_name on;
        proxy_set_header Host overpass.private.coffee;
        proxy_set_header Origin "https://overpass.private.coffee";
        proxy_set_header Referer "https://overpass.private.coffee/api/interpreter";
        proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";
        proxy_connect_timeout 15s; proxy_send_timeout 120s; proxy_read_timeout 120s;
        # A cell that answered once is kept for 30 days and served even while
        # the mirror is down (stale), so a flaky instance cannot undo progress
        # the browser already paid for.
        proxy_cache overpass;
        proxy_cache_key "$scheme$host$request_uri$request_body";
        proxy_cache_methods POST;
        proxy_cache_valid 200 30d;
        proxy_cache_lock on;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        add_header X-Cache $upstream_cache_status always;
        add_header Access-Control-Allow-Origin "*" always;
    }
    location ^~ /overpass/mail/ {
        resolver 1.1.1.1 8.8.8.8 ipv6=off valid=300s;
        set $overpass_mail_host "maps.mail.ru";
        proxy_pass https://$overpass_mail_host/osm/tools/overpass/api/;
        proxy_ssl_server_name on;
        proxy_set_header Host maps.mail.ru;
        proxy_set_header Origin "https://maps.mail.ru";
        proxy_set_header Referer "https://maps.mail.ru/osm/tools/overpass/api/interpreter";
        proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36";
        proxy_connect_timeout 15s; proxy_send_timeout 120s; proxy_read_timeout 120s;
        # A cell that answered once is kept for 30 days and served even while
        # the mirror is down (stale), so a flaky instance cannot undo progress
        # the browser already paid for.
        proxy_cache overpass;
        proxy_cache_key "$scheme$host$request_uri$request_body";
        proxy_cache_methods POST;
        proxy_cache_valid 200 30d;
        proxy_cache_lock on;
        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
        add_header X-Cache $upstream_cache_status always;
        add_header Access-Control-Allow-Origin "*" always;
    }

    # CORS preflight handler
    location ~* \.(png|jpg)$ {
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin "*" always;
            add_header Access-Control-Allow-Methods "GET, HEAD, OPTIONS" always;
            add_header Access-Control-Max-Age 86400 always;
            add_header Content-Length 0;
            return 204;
        }
        add_header Access-Control-Allow-Origin "*" always;
    }
}