# 部署前替换管理域名、证书路径和端口占位符，不能直接加载本文件。
# 管理域名由部署环境决定，不在应用代码中固定。
# 与其他站点共用监听端口，不重复声明 default_server。

server {
    listen __HTTP_PORT__;
    listen [::]:__HTTP_PORT__;
    server_name __MANAGEMENT_HOST__;

    # 不能使用 server 级 return，否则会先于挑战路径反代执行。
    # 将 http-challenge.conf.example 替换占位符后保存到此绝对路径。
    include __HTTP_CHALLENGE_SNIPPET_PATH__;

    location / {
        return 308 __MANAGEMENT_ORIGIN__$request_uri;
    }
}

server {
    listen __HTTPS_PORT__ ssl;
    listen [::]:__HTTPS_PORT__ ssl;
    server_name __MANAGEMENT_HOST__;
    ssl_certificate __FULLCHAIN_PATH__;
    ssl_certificate_key __PRIVATE_KEY_PATH__;
    ssl_protocols TLSv1.2 TLSv1.3;
    client_max_body_size 64m;
    access_log /var/log/nginx/scert-access.log combined;
    error_log /var/log/nginx/scert-error.log warn;

    location / {
        proxy_pass https://127.0.0.1:__UPSTREAM_PORT__;
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Port __HTTPS_PORT__;
        proxy_set_header Connection '';
        proxy_ssl_server_name on;
        proxy_ssl_name __MANAGEMENT_HOST__;
        proxy_ssl_verify on;
        proxy_ssl_verify_depth 3;
        proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
        proxy_connect_timeout 5s;
        proxy_read_timeout 180s;
        proxy_send_timeout 90s;
    }
}