upstream elasticsearch {
  server 127.0.0.1:9200;
}

server {
  listen *:80;
  server_name <ip_add_of_localhost>;
  root /var/www/kibana;
  access_log /var/log/nginx/access.log;
  error_log /var/log/nginx/error.log;

  satisfy any;
  allow 192.168.0.0/16;
  allow <ip_add_of_localhost>;
  allow 10.0.0.0/8;
  allow 127.0.0.1;
  deny all;

  location / {
    root  /var/www/kibana;
    index  index.html;
    auth_basic "Restricted";
    auth_basic_user_file /var/www/htpasswd;

  }

  # Keep elasticsearch behind a proxy with http auth
  location /es/ {
    rewrite ^/es/_aliases$ /_aliases break;
    rewrite ^/es/_nodes$ /_nodes break;
    rewrite ^/es/(.*/_mapping)$ /$1 break;
    return 403;

    limit_except GET {
      deny all;
    }

    auth_basic "Restricted";
    auth_basic_user_file /var/www/htpasswd;

    proxy_pass http://elasticsearch;

    proxy_redirect off;

    proxy_set_header  X-Real-IP  $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;

    # For CORS Ajax
    proxy_pass_header Access-Control-Allow-Origin;
    proxy_pass_header Access-Control-Allow-Methods;
    proxy_hide_header Access-Control-Allow-Headers;
    add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
    add_header Access-Control-Allow-Credentials true;
  }


  location ~ ^/es/(.*/_search)$ {
    rewrite ^/es/(.*/_search)$ /$1 break;

    limit_except POST {
      deny all;
    }

    proxy_pass http://elasticsearch;

    proxy_redirect off;

    proxy_set_header  X-Real-IP  $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;

    # For CORS Ajax
    proxy_pass_header Access-Control-Allow-Origin;
    proxy_pass_header Access-Control-Allow-Methods;
    proxy_hide_header Access-Control-Allow-Headers;
    add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
    add_header Access-Control-Allow-Credentials true;

    auth_basic "Restricted";
    auth_basic_user_file /var/www/htpasswd;

  }

  location /es/kibana-int/ {
    rewrite ^/es/(kibana-int/.*)$ /$1 break;
    proxy_pass http://127.0.0.1:9200;

    auth_basic "Restricted";
    auth_basic_user_file /var/www/htpasswd;

    proxy_redirect off;

    proxy_set_header  X-Real-IP  $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;

    # For CORS Ajax
    proxy_pass_header Access-Control-Allow-Origin;
    proxy_pass_header Access-Control-Allow-Methods;
    proxy_hide_header Access-Control-Allow-Headers;
    add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
    add_header Access-Control-Allow-Credentials true;

  }

}