nginx-proxy-gdp.test.conf

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
# server port the client connected to
map $http_x_forwarded_port $proxy_x_forwarded_port {
  default $http_x_forwarded_port;
  ''      $server_port;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}

# Set appropriate X-Forwarded-Ssl header
map $scheme $proxy_x_forwarded_ssl {
  default off;
  https on;
}

log_format migvhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';

access_log off;
# HTTP 1.1 support

# IMPORTANT: Catch all plain HTTP vhost to avoid ending up as an open proxy
server {
	listen 80 default_server;
	listen [::]:80 default_server;
	# NOTE: invalid vhost if we actually get here - always fail
	return 403;
}

# Now handle all valid vhost http requests with proxy for LetsEncrypt, etc.
server {
	listen 80;
	listen [::]:80;
	server_name gdp.test www.gdp.test ext.gdp.test cert.gdp.test oid.gdp.test sid.gdp.test;

	# NOTE: this will likely fail unless an .well-known/acme-challenge path
	#       is requested because the backend will try to redirect it to
	#       internal https location instead.
	location / {
		proxy_pass http://gdp.test;
	}
	# TODO: force all but LetsEncrypt verification requests to https	
	#location / {
	#	return 301 https://$host$request_uri;
	#}
	access_log /var/log/nginx/access.log migvhost;
}

# gdp.test
upstream gdp.test {
			## Can be connected with "docker-migrid_default" network
			# migrid
			server migrid:80;
}

# www.gdp.test (public web server on HTTPS)
upstream www.gdp.test {
			## Can be connected with "docker-migrid_default" network
			# migrid
			server migrid:444;
}

server {
	server_name www.gdp.test;
	listen 444 ssl http2 ;
	access_log /var/log/nginx/access.log migvhost;

	ssl_certificate /etc/nginx/certs/www.gdp.test.crt;
	ssl_certificate_key /etc/nginx/certs/www.gdp.test.key;
        # NOTE: allow bigger uploads to avoid breaking chunked upload on web
        client_max_body_size 64M; 
        # NOTE: include the general https hardening everywhere with HTTPS 
        include /etc/nginx/harden-https.conf;        
	location / {
		proxy_pass https://www.gdp.test;
	}
}

# ext.gdp.test (internal openid vhost - i.e. mig_oid)
# IMPORTANT: openid redirect ping-pong appears to require vhost on port 443
#            We moved www vhost to 444 instead until we have multiple IPs.
upstream ext.gdp.test {
			## Can be connected with "docker-migrid_default" network
			# migrid
			server migrid:443;
}

server {
	server_name ext.gdp.test;
	listen 443 ssl http2 ;
	access_log /var/log/nginx/access.log migvhost;

	ssl_certificate /etc/nginx/certs/ext.gdp.test.crt;
	ssl_certificate_key /etc/nginx/certs/ext.gdp.test.key;
        # NOTE: allow bigger uploads to avoid breaking chunked upload on web
        client_max_body_size 64M; 
        # NOTE: include the general https hardening everywhere with HTTPS 
        include /etc/nginx/harden-https.conf;        
	location / {
		proxy_pass https://ext.gdp.test;
	}
}

# oid.gdp.test (external openid vhost - i.e. ext_oid)
upstream oid.gdp.test {
			## Can be connected with "docker-migrid_default" network
			# migrid
			server migrid:445;
}

server {
	server_name oid.gdp.test;
	listen 445 ssl http2 ;
	access_log /var/log/nginx/access.log migvhost;
	ssl_certificate /etc/nginx/certs/oid.gdp.test.crt;
	ssl_certificate_key /etc/nginx/certs/oid.gdp.test.key;
        # NOTE: allow bigger uploads to avoid breaking chunked upload on web
        client_max_body_size 64M; 
        # NOTE: include the general https hardening everywhere with HTTPS 
        include /etc/nginx/harden-https.conf;        
	location / {
		proxy_pass https://oid.gdp.test;
	}
}

# cert.gdp.test (internal cert vhost - i.e. mig_cert)
upstream cert.gdp.test {
			## Can be connected with "docker-migrid_default" network
			# migrid
			server migrid:446;
}

server {
	server_name cert.gdp.test;
	listen 446 ssl http2 ;
	access_log /var/log/nginx/access.log migvhost;

	ssl_certificate /etc/nginx/certs/cert.gdp.test.crt;
	ssl_certificate_key /etc/nginx/certs/cert.gdp.test.key;
        # NOTE: allow bigger uploads to avoid breaking chunked upload on web
        client_max_body_size 64M; 
        # NOTE: include the general https hardening everywhere with HTTPS 
        include /etc/nginx/harden-https.conf;        
	location / {
		proxy_pass https://cert.gdp.test;
	}
}

# sid.gdp.test
upstream sid.gdp.test {
			## Can be connected with "docker-migrid_default" network
			# migrid
			server migrid:448;
}

server {
	server_name sid.gdp.test;
	listen 448 ssl http2 ;
	access_log /var/log/nginx/access.log migvhost;
	ssl_certificate /etc/nginx/certs/sid.gdp.test.crt;
	ssl_certificate_key /etc/nginx/certs/sid.gdp.test.key;
        # NOTE: allow bigger uploads to avoid breaking chunked upload on web
        client_max_body_size 64M; 
        # NOTE: include the general https hardening everywhere with HTTPS 
        include /etc/nginx/harden-https.conf;        
	location / {
		proxy_pass https://sid.gdp.test;
	}
}