nginx.template

worker_processes 8;

events { 
  worker_connections 2048; 
}

http {

  map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
  }

  map $status $loggable {
    ~^[23]  0;
    default 1;
  }

  upstream aloes_ws_api_servers {
    least_conn;
    server 127.0.0.1:3001;
    server 127.0.0.1:3002;
  }

  log_format custom_combined '$server_addr - $remote_addr [$time_local] "$request" $status $body_bytes_sent $upstream_addr "$http_referer" "$http_user_agent"';

  access_log /etc/nginx/log/http-access-${NGINX_SERVER_HOST}.log custom_combined buffer=32k flush=1m;
  error_log /etc/nginx/log/http-error-${NGINX_SERVER_HOST}.log warn;

  server {
    listen ${HTTP_SERVER_PORT};
    listen [::]:${HTTP_SERVER_PORT} ipv6only=on;
    server_name ${NGINX_SERVER_HOST};

    # real_ip_header      X-Forwarded-For;
    # real_ip_recursive on;

    location / {
      # proxy_bind 127.0.1.1;
      proxy_pass http://aloes_ws_api_servers;
      proxy_redirect off;
      proxy_http_version 1.1;
      proxy_read_timeout 90;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
      proxy_set_header Host $host;
      proxy_set_header X-Scheme $scheme;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Real-IP $remote_addr;
    }

  }

  server {
    listen ${HTTPS_SERVER_PORT} ssl;
    listen [::]:${HTTPS_SERVER_PORT} ssl ipv6only=on;
    server_name ${NGINX_SERVER_HOST};

    ssl_certificate_key /etc/nginx/certs/key.pem;
    ssl_certificate /etc/nginx/certs/cert.pem;

    # real_ip_header      X-Forwarded-For;

    location / {
      # proxy_bind $server_addr;
      proxy_pass http://aloes_ws_api_servers;
      proxy_redirect off;
      proxy_http_version 1.1;
      proxy_read_timeout 90;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection $connection_upgrade;
      proxy_set_header Host $host;
      proxy_set_header X-Scheme $scheme;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Real-IP $remote_addr;
    }

  }
}


stream {
  log_format mqtt '$server_addr - $remote_addr [$time_local] $protocol $status $bytes_received $bytes_sent $upstream_addr';

  access_log /etc/nginx/log/mqtt-access-${NGINX_SERVER_HOST}.log mqtt buffer=32k flush=1m;
  error_log /etc/nginx/log/mqtt-error-${NGINX_SERVER_HOST}.log; # Health check notifications

  upstream aloes_mqtt_api_servers {
    least_conn;
    server 127.0.0.1:1884;
    server 127.0.0.1:1885;
  }

  server {
    listen ${MQTT_BROKER_PORT};    
    listen [::]:${MQTT_BROKER_PORT} ipv6only=on;

    proxy_protocol on;
    proxy_pass aloes_mqtt_api_servers;
    proxy_connect_timeout 2s;
    proxy_timeout 60s;
    # proxy_socket_keepalive on;
  }

  server {
    listen ${MQTTS_BROKER_PORT} ssl;    
    listen [::]:${MQTTS_BROKER_PORT} ssl ipv6only=on;

    ssl_certificate_key /etc/nginx/certs/key.pem;
    ssl_certificate /etc/nginx/certs/cert.pem;
    # ssl_dhparam /etc/nginx/certs/dhparam.pem;
    ssl_protocols       SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_session_cache   shared:SSL:20m;
    ssl_session_timeout 8h;
    ssl_handshake_timeout 10s;
    # ssl_session_tickets off;

    proxy_protocol on;
    proxy_pass aloes_mqtt_api_servers;
    proxy_buffer_size 16k;

    proxy_connect_timeout 5s;
    proxy_timeout 60s;
  }

}