gollum.conf

server {
    server_name wiki.netpress.com;

    location = /favicon.ico {
        alias /home/gollum/gollum-wiki-oauth/img/favicon.ico;
    }

    location /oauth2/ {
        proxy_pass http://127.0.0.1:4180;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-Auth-Request-Redirect $request_uri;
    }

    location / {
        proxy_pass http://127.0.0.1:4567;
        auth_request /oauth2/auth;
        error_page 401 = /oauth2/;

        # pass information via X-Email headers to backend
        # requires running with --set-xauthrequest and --pass-access-token
        auth_request_set $email $upstream_http_x_auth_request_email;
        auth_request_set $token $upstream_http_x_auth_request_access_token;
        proxy_set_header X-Email $email;
        proxy_set_header X-Access-Token $token;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass_header Server;
        proxy_connect_timeout 3s;
        proxy_send_timeout 10s;
        proxy_read_timeout 10s;
        proxy_buffers 4 32k;
        client_max_body_size 500m;
        client_body_buffer_size 128k;
    }
    access_log /var/log/nginx/gollum-access.log;
    error_log /var/log/nginx/gollum-error.log;

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/wiki.netpress.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/wiki.netpress.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = wiki.netpress.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name wiki.netpress.com;
    listen 80;
    return 404; # managed by Certbot
}