nginx.conf.ssl.template

worker_processes auto;

events {
    worker_connections 1024;
}

http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;
    server_tokens off;

    # Redirect HTTP -> HTTPS
    server {
        listen 8080;
        server_name localhost;

        # the default location redirects to https
        location / {
            return 301 https://$host:__EXTERNAL_HTTPS_PORT__$request_uri;
        }

	# Healtcheck
        location /health {
          stub_status on;
          access_log off;
          allow 127.0.0.1;
          deny all;
        }
    }

    # SSL configuration
    server {
        listen 8443 ssl default_server;

        ssl_certificate             "/opt/ssl/linstor-gui.crt";
        ssl_certificate_key         "/opt/ssl/linstor-gui.key";
        ssl_protocols               TLSv1.2;
        ssl_dhparam                 /opt/ssl/dh.pem;
        ssl_prefer_server_ciphers   on;
        ssl_ciphers                 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
        ssl_stapling                on;
        ssl_stapling_verify         on;
        ssl_session_cache           none;
        ssl_session_tickets         off;

        root /usr/share/nginx/html;
        index index.html;

        # Protect against click-jacking https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)
        add_header X-Frame-Options "DENY";

        location / {
            try_files $uri $uri/ /index.html;
        }

        location /v1 {
            proxy_pass __LB_LINSTOR_API_HOST__;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        location /metrics {
            proxy_pass __LB_LINSTOR_API_HOST__;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        location /api/v2 {
            proxy_pass __LB_GATEWAY_API_HOST__;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   /usr/share/nginx/html;
        }
    }
}