static.conf

real_ip_header X-Forwarded-For;
real_ip_recursive on;
set_real_ip_from 172.0.0.0/8;
set_real_ip_from 128.180.1.79/32;
set_real_ip_from 128.180.1.80/32;

server {
    listen       80 default_server;
    listen  [::]:80 default_server;
    server_name _;

    # Turnstile fallback kill switch. Default off; set to 1, run nginx -t,
    # then reload nginx to enable the fallback rules.
    set $tf_fallback_enabled 0;

    location ~ ^/sites/\w+/files/styles/islandora_imagecache_image_style {
        return 404;
    }

    # Turnstile fallback: block bots that slip past the challenge. Match rules
    # live in turnstile-fallback.conf (edit that file to add offenders). The
    # fallback rewrites directly to the styled bot-block.html page.
    location = /bot-block.html {
        internal;
        root /etc/nginx/conf.d;
    }
    if ($turnstile_fallback_block) {
        rewrite ^ /bot-block.html last;
    }

    if ($http_user_agent ~ (OAI-SearchBot|ChatGPT|Scrapy|ImagesiftBot|YandexBot|Bytespider|Sogou|SemrushBot|AcademicBotRTU|PetalBot|GPTBot|DataForSeoBot|test-bot) ) {
        return 403;
    }

    location = /healthcheck {
        access_log off;
        return 200;
    }

    # if there's any query string at all, go straight to Drupal
    error_page 418 = @drupal;
    location / {
        if ($args) {
            return 418;
        }

        root   /usr/share/nginx/drupal;
        index  index.html;
        try_files $uri/index.html $uri @fallback;
    }

    location ~ ^/node/\d+/book-manifest$ {
        if ($args) {
            return 418;
        }

        root   /usr/share/nginx/iiif;
        try_files $uri.json @fallback;
    }

    location @fallback {
        root   /var/www/drupal/web;
        try_files $uri @drupal;
    }

    location @drupal {
        # when drupal container is down
        # still allow this static config to service files on disk
        resolver 127.0.0.11 valid=30s;
        set                   $upstream "drupal";

        proxy_pass            http://$upstream;
        proxy_ssl_server_name on;
        proxy_set_header      Host $host;
        proxy_set_header      X-Forwarded-Proto https;
        proxy_set_header      X-Forwarded-Port 443;
        proxy_redirect        https://drupal/ https://$host/;
    }

    error_page 500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }
}