nuts-foundation/nuts-node

load_module /usr/lib/nginx/modules/ngx_http_js_module.so;

user  nginx;
worker_processes  1;

error_log  /var/log/nginx/error.log debug;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    js_import oauth2.js;
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    keepalive_timeout  65;

    include /etc/nginx/conf.d/*.conf;

    upstream nodeA-internal {
      server nodeA-backend:8081;
    }
    upstream nodeA-external {
      server nodeA-backend:8080;
    }

    server {
      server_name nodeA;
      listen                    443 ssl;
      http2                     on;
      ssl_certificate           /etc/nginx/ssl/server.pem;
      ssl_certificate_key       /etc/nginx/ssl/key.pem;
      ssl_client_certificate    /etc/nginx/ssl/truststore.pem;
      ssl_verify_client         optional;
      ssl_verify_depth          1;
      ssl_protocols             TLSv1.3;

      location / {
        proxy_set_header X-Ssl-Client-Cert $ssl_client_escaped_cert;
        proxy_pass http://nodeA-external;
      }

      # check access via token introspection as described by https://www.nginx.com/blog/validating-oauth-2-0-access-tokens-nginx/
      location /resource {
          js_content oauth2.introspectAccessToken;
      }

      # Location in javascript subrequest.
      # this is needed to set headers and method
      location /_oauth2_send_request {
          internal;
          proxy_method      POST;
          proxy_set_header  Content-Type "application/x-www-form-urlencoded";
          proxy_pass        http://nodeA-internal/internal/auth/v2/accesstoken/introspect;
      }
      location /_dpop_send_request {
          internal;
          proxy_method      POST;
          proxy_set_header  Content-Type "application/json";
          proxy_pass        http://nodeA-internal/internal/auth/v2/dpop/validate;
      }
    }
}