# 替换占位符后，将本文件 include 到每个 HTTP-01 域名现有的 80 端口 server 块。
# 只匹配挑战路径；不要新增 default_server，不改动现有业务 location。
# server 级 return/rewrite 必须移到非挑战 location 中，避免抢先重定向。
location ^~ /.well-known/acme-challenge/ {
    proxy_pass https://127.0.0.1:__UPSTREAM_PORT__;
    proxy_http_version 1.1;
    proxy_set_header Host $http_host;
    proxy_set_header Connection '';
    proxy_set_header Cookie '';
    proxy_set_header Authorization '';
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Proto http;
    proxy_ssl_server_name on;
    proxy_ssl_name __MANAGEMENT_HOST__;
    proxy_ssl_verify on;
    proxy_ssl_verify_depth 3;
    proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
    proxy_cache off;
    proxy_intercept_errors off;
    proxy_connect_timeout 5s;
    proxy_read_timeout 10s;
    proxy_send_timeout 10s;
    # 挑战令牌不进入常规访问日志；应用层仍检查 Host、令牌与订单有效期。
    access_log off;
}