default.conf.template

map $http_upgrade $connection_upgrade {
	default upgrade;
	'' close;
}
server {
	listen       80;
	server_name  localhost;

	location / {
		root   /usr/share/nginx/html;
		index  index.html index.htm;
	}

	location ^~ /prod-api/ {
		proxy_pass ${API_URL}; #http://iiidevops-api-master.ingress-dev2.iiidevops.org/;
	}

	location ^~ /socket.io/ {
		proxy_pass ${API_URL}socket.io/; #http://iiidevops-api-master.ingress-dev2.iiidevops.org/socket.io/;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
		# proxy_set_header Host $host;
	}
	# for swagger-ui
	location ^~ /swagger-ui/ {
		proxy_pass ${API_URL}swagger-ui/;
	}
	location ^~ /flask-apispec/ {
		proxy_pass ${API_URL}flask-apispec/;
	}
	location ^~ /swagger/ {
		proxy_pass ${API_URL}swagger/;
	}

	error_page   500 502 503 504  /50x.html;
	location = /50x.html {
		root   /usr/share/nginx/html;
	}
	client_max_body_size 100M;
	ssl_protocols TLSv1.3;# Requires nginx >= 1.13.0 else use TLSv1.2
	ssl_prefer_server_ciphers on;
	ssl_dhparam /etc/nginx/dhparam.pem; # openssl dhparam -out /etc/nginx/dhparam.pem 4096
	ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
	ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
	ssl_session_timeout  10m;
	ssl_session_cache shared:SSL:10m;
	ssl_session_tickets off; # Requires nginx >= 1.5.9
	ssl_stapling on; # Requires nginx >= 1.3.7
	ssl_stapling_verify on; # Requires nginx => 1.3.7
	#resolver $DNS-IP-1 $DNS-IP-2 valid=300s;
	#resolver_timeout 5s;
	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
	add_header X-Frame-Options DENY;
	add_header X-Content-Type-Options nosniff;
	add_header X-XSS-Protection "1; mode=block";
	add_header Referrer-Policy "no-referrer-when-downgrade";
}