geo $msuser_whitelist {
	default 0;
	127.0.0.1 1;
	{{ worker_ip }} 1;
}
map $msuser_whitelist $msuser_allowed {
	0 $secure_link;
	1 1;
}

server {
	listen 80;
	server_name {{ server_name }};

	rewrite ^ https://$host$request_uri? permanent;
}

server {
	listen 443 ssl;
	server_name {{ server_name }};
	root /var/www/msuser;

	access_log /var/log/nginx/access_msuser.log;
	error_log /var/log/nginx/error_msuser.log;

	location /public {
		expires 30d;
		add_header Pragma public;
		add_header Cache-Control "public";
	}
	location /resources {
		location ~ \.ts$ {
		}
		location ~ \.xml$ {
		}
		secure_link $arg_st,$arg_e;
		secure_link_md5 "{{ secret }}$uri$arg_e$remote_addr";
		# link expired
		if ($msuser_allowed = "0") {
			return 410;
		}
		# bad hash
		if ($msuser_allowed = "") {
			return 403;
		}
	}
	location /static {
		expires 30d;
		add_header Pragma public;
		add_header Cache-Control "public";
	}
	location /crossdomain {
		expires 30d;
		add_header Pragma public;
		add_header Cache-Control "public";
	}
	location /streaming/ {
		proxy_pass http://localhost:1935/live/;
	}
	location / {
		uwsgi_pass unix:///home/msuser/mstmp/uwsgi.sock;
		include /etc/nginx/uwsgi_params;
	}
}
