[add] initial commit

proxy/files/nginx.conf

@@ -0,0 +1,68 @@
+worker_processes 1;
+
+events { worker_connections 1024; }
+
+# required for non root
+pid        /tmp/nginx.pid;
+
+http {
+
+    # required for non root
+    client_body_temp_path /tmp/client_temp;
+    proxy_temp_path       /tmp/proxy_temp_path;
+    fastcgi_temp_path     /tmp/fastcgi_temp;
+    uwsgi_temp_path       /tmp/uwsgi_temp;
+    scgi_temp_path        /tmp/scgi_temp; 
+
+    client_max_body_size 1m;
+        
+    server {
+        listen 8080 default_server;
+
+        # prevent redirecting to 8080 port
+        # (e.g. when trailing slash is missed)
+        port_in_redirect off;
+
+        # letsencrypt
+        location /.well-known/acme-challenge/ {
+            root /service/html/certbot;
+        }
+
+        location /check {
+            # set alias (instead of root) to not append /check to path
+            alias /service/html/check;
+        }
+
+        location / {
+            return 302 https://$host$request_uri;
+        }
+    }
+
+    server {
+        listen 8443 ssl;
+
+        # prevent redirecting to 8080 port
+        # (e.g. when trailing slash is missed)
+        port_in_redirect off;
+
+        server_name example.com www.example.com localhost;
+        
+        ssl_certificate        /service/ssl/example.com/fullchain.pem;
+        ssl_certificate_key    /service/ssl/example.com/privkey.pem;
+        
+        location / {
+            # allow for upstream to be offline by setting
+            # docker dns resolver and a variable for the server
+            resolver           127.0.0.11 valid=30s;
+            set                $kweb kweb;
+            proxy_pass         http://$kweb:8080;
+
+            proxy_redirect     off;
+            proxy_set_header   Host $host;
+            proxy_set_header   X-Real-IP $remote_addr;
+            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header   X-Forwarded-Host $server_name;
+        }
+    }
+
+}