nuts-foundation/nuts-node

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log debug;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;

    upstream nodeA-http-external {
      server nodeA-backend:8080;
    }
    upstream nodeA-http-internal {
      server nodeA-backend:8081;
    }

    server {
      server_name nodeA;
      listen                    443 ssl;
      http2                     on;
      ssl_certificate           /etc/nginx/ssl/server.pem;
      ssl_certificate_key       /etc/nginx/ssl/key.pem;
      ssl_client_certificate    /etc/nginx/ssl/truststore.pem;
      ssl_verify_client         on;
      ssl_verify_depth          1;
      ssl_protocols             TLSv1.3;

      location / {
        proxy_set_header X-Ssl-Client-Cert $ssl_client_escaped_cert;
        proxy_pass http://nodeA-http-external;
      }

      location /ping {
        auth_request /delegated;
        auth_request_set $auth_status $upstream_status;
      }

      location = /delegated {
        internal;
        proxy_pass http://nodeA-http-internal/internal/auth/v1/accesstoken/verify;
        proxy_method HEAD;
        proxy_pass_request_body off;
        proxy_set_header X-Ssl-Client-Cert $ssl_client_escaped_cert;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
      }
    }
}