reverse-proxy.template.conf

server {

  listen 80;

  client_max_body_size 0;
  chunked_transfer_encoding on;

  proxy_redirect                      off;
  proxy_set_header Host               $host;
  proxy_set_header X-Real-IP          $remote_addr;
  proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto  $scheme;

  # Mutual TLS:
  ssl_client_certificate   /etc/ssl/certs/dnpm-ca-cert.pem; # Path to trusted CA certificate (DNPM CA)
  ssl_verify_client        optional;
  ssl_verify_depth         1;

  location ~ /api(/.*)?/peer2peer {
    if ($ssl_client_verify != "SUCCESS") {
       return 403;
    }

    rewrite ^/api(.*)$ $1 break;

    proxy_pass http://backend:9000;
  }

  location /api/ {
      proxy_pass http://backend:9000/;
  }

  location /auth/ {
      proxy_pass http://authup:3000/;
  }

  location / {
      proxy_pass http://portal:3000;
  }

}