cloudfoundry/stratos

worker_processes 2;

events {
    worker_connections              4096;
    use                             epoll;
}

http {

    upstream portalproxy {
        least_conn;
        server                      <%= p('stratos_ui.backend.host') %>:<%= p('stratos_ui.backend.port') %>;
        keepalive                   32;
    }

    include                         /var/vcap/packages/nginx/conf/mime.types;
    default_type                    application/octet-stream;
    keepalive_timeout               70;
    proxy_read_timeout              200;
    sendfile                        off;
    tcp_nopush                      on;
    tcp_nodelay                     on;
    gzip                            on;
    gzip_min_length                 1000;
    gzip_proxied                    any;
    gzip_types                      text/plain text/html text/css text/xml
                                    application/x-javascript application/xml
                                    application/atom+xml text/javascript;

    proxy_next_upstream             error;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      '';
    }

    ssl_session_cache               shared:SSL:10m;
    ssl_session_timeout             10m;

    server {
        listen                      80;
        return                      301 https://$host$request_uri;
    }

    server {
        listen                      443 ssl;

        ssl_certificate             /var/vcap/jobs/frontend/config/nginx.crt;
        ssl_certificate_key         /var/vcap/jobs/frontend/config/nginx.key;
        ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers                 HIGH:!aNULL:!MD5;

        client_max_body_size        50M;

        location /pp/ {
            proxy_pass_header       Server;
            proxy_set_header        Host $http_host;
            proxy_redirect          off;
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Scheme $scheme;
            proxy_pass              https://portalproxy/pp/;
            proxy_intercept_errors  on;
            proxy_http_version      1.1;
            proxy_set_header        Upgrade $http_upgrade;
            proxy_set_header        Connection $connection_upgrade;
        }

        location /api/ {
            proxy_pass_header       Server;
            proxy_set_header        Host $http_host;
            proxy_redirect          off;
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Scheme $scheme;
            proxy_pass              https://portalproxy/api/;
            proxy_intercept_errors  on;
            proxy_http_version      1.1;
            proxy_set_header        Upgrade $http_upgrade;
            proxy_set_header        Connection $connection_upgrade;
        }        

        location / {
            root                    /var/vcap/packages/frontend;
            add_header X-Frame-Options SAMEORIGIN;
            add_header Cache-Control no-cache;
        }
    }
}