# Legacy-TLS CalDAV endpoint for Android 2.3, inside Nginx Proxy Manager.
#
# Install: copy to <npm data dir>/nginx/custom/http.conf (NPM includes it at the end of its
# http block; if that file already exists, append this server block to it). Then publish
# port 8443 on the NPM container and forward it on the router. See README.md.
#
# Phone -> nxc.anosanube.ovh:8443 (TLS 1.0, self-signed cert pinned by the app)
#       -> this block -> NPM's own https proxy host for nxc.anosanube.ovh -> Nextcloud
# Going back through NPM's existing proxy host reuses its Nextcloud settings, so you don't
# need to repeat the backend address here.

server {
    listen 8443 ssl;
    listen [::]:8443 ssl;   # remove if NPM runs with DISABLE_IPV6
    server_name _;

    set $nc_host nxc.anosanube.ovh;

    # Long-lived self-signed certificate (bridge/make-cert.sh). Not NPM's Let's Encrypt one:
    # Android 2.3 doesn't trust ISRG Root X1, and pinning a cert that renews every 60 days
    # would trip the app's "certificate changed" warning each time.
    ssl_certificate     /data/legacy-caldav/bridge.crt;
    ssl_certificate_key /data/legacy-caldav/bridge.key;

    # Android 2.3: TLS 1.0, AES-CBC-SHA. Only this port; NPM's own hosts on 443 are untouched.
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:AES128-SHA:AES256-SHA:@SECLEVEL=0";
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:legacy_caldav:1m;
    ssl_session_timeout 1h;

    absolute_redirect off;
    client_max_body_size 5m;
    access_log /data/logs/legacy-caldav_access.log;
    error_log  /data/logs/legacy-caldav_error.log warn;

    # HSTS from the proxy host is meant for https://nxc.anosanube.ovh, not this self-signed port.
    proxy_hide_header Strict-Transport-Security;

    location /remote.php/dav/ {
        # NPM's own HTTPS listener, matched by SNI to the nxc.anosanube.ovh proxy host.
        proxy_pass https://127.0.0.1:443;
        proxy_ssl_server_name on;
        proxy_ssl_name $nc_host;
        proxy_ssl_verify off;   # loopback to ourselves

        proxy_set_header Host $nc_host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_read_timeout 120s;
        proxy_buffering off;
        proxy_redirect ~^https?://[^/]+(/.*)$ $1;
    }

    location = /.well-known/caldav {
        return 301 /remote.php/dav/;
    }

    location / {
        return 404;
    }
}