# synapse-proxy/nginx.conf
user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  10240;
}
worker_rlimit_nofile 20480;


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;

    # nginx-proxy version : 1.6.4
    # Networks available to the container running docker-gen (which are assumed to
    # match the networks available to the container running nginx):
    #     backplane
    # If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
    # scheme used to connect to this server
    map $http_x_forwarded_proto $proxy_x_forwarded_proto {
        default $scheme;
        '' $scheme;
    }
    map $http_x_forwarded_host $proxy_x_forwarded_host {
        default $host;
        '' $host;
    }
    # If we receive X-Forwarded-Port, pass it through; otherwise, pass along the
    # server port the client connected to
    map $http_x_forwarded_port $proxy_x_forwarded_port {
        default $server_port;
        '' $server_port;
    }
    map $server_port $host_port {
        default :$server_port;
        8448 '';
    }
    # If the request from the downstream client has an "Upgrade:" header (set to any
    # non-empty value), pass "Connection: upgrade" to the upstream (backend) server.
    # Otherwise, the value for the "Connection" header depends on whether the user
    # has enabled keepalive to the upstream server.
    map $http_upgrade $proxy_connection {
        default upgrade;
        '' $proxy_connection_noupgrade;
    }
    map $upstream_keepalive $proxy_connection_noupgrade {
        # Preserve nginx's default behavior (send "Connection: close").
        default close;
        # Use an empty string to cancel nginx's default behavior.
        true '';
    }
    # Abuse the map directive (see <https://stackoverflow.com/q/14433309>) to ensure
    # that $upstream_keepalive is always defined.  This is necessary because:
    #   - The $proxy_connection variable is indirectly derived from
    #     $upstream_keepalive, so $upstream_keepalive must be defined whenever
    #     $proxy_connection is resolved.
    #   - The $proxy_connection variable is used in a proxy_set_header directive in
    #     the http block, so it is always fully resolved for every request -- even
    #     those where proxy_pass is not used (e.g., unknown virtual host).
    map "" $upstream_keepalive {
        # The value here should not matter because it should always be overridden in
        # a location block (see the "location" template) for all requests where the
        # value actually matters.
        default false;
    }
    # Apply fix for very long server names
    server_names_hash_bucket_size 128;
    # Default dhparam
    ssl_dhparam /etc/nginx/dhparam/dhparam.pem;
    # Set appropriate X-Forwarded-Ssl header based on $proxy_x_forwarded_proto
    map $proxy_x_forwarded_proto $proxy_x_forwarded_ssl {
        default off;
        https on;
    }
    gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
    log_format vhost escape=default '$host $remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$upstream_addr"';
    access_log off;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1
305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305';
        ssl_prefer_server_ciphers off;
    error_log /dev/stderr;
    resolver 127.0.0.11;
    # HTTP 1.1 support
    proxy_http_version 1.1;
    proxy_set_header Host $host$host_port;
    proxy_set_header Host $host$host_port;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $proxy_connection;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $proxy_x_forwarded_host;
    proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
    proxy_set_header X-Forwarded-Ssl $proxy_x_forwarded_ssl;
    proxy_set_header X-Forwarded-Port $proxy_x_forwarded_port;
    proxy_set_header X-Original-URI $request_uri;
    # Mitigate httpoxy attack (see README for details)
    proxy_set_header Proxy "";
    # example.net/
    upstream example.net {
        # Container: synapse-app-1
        #     networks:
        #         backplane (reachable)
        #         synapse_default (reachable)
        #     IP address: 172.20.0.3
        #     exposed ports (first ten): 8008/tcp 8009/tcp 8448/tcp
        #     default port: 80
        #     using port: 8008
	server 172.20.0.3:8008;  # find this value from docker network inspect synapse_default
    }
    server {
        server_name example.net;
        access_log /var/log/nginx/access.log vhost;
        http2 on;
        listen 8448 ssl ;
        ssl_session_timeout 5m;
        ssl_session_cache shared:SSL:50m;
        ssl_session_tickets off;
        ssl_certificate /etc/nginx/certs/example.net.crt;
        ssl_certificate_key /etc/nginx/certs/example.net.key;
        ssl_stapling on;
        ssl_stapling_verify on;
        ssl_trusted_certificate /etc/nginx/certs/example.net.chain.pem;
        set $sts_header "";
        if ($https) {
            set $sts_header "max-age=31536000";
        }
        add_header Strict-Transport-Security $sts_header always;
        location / {
            proxy_pass http://example.net;
            set $upstream_keepalive false;
        }
    }
}

include /etc/nginx/toplevel.conf.d/*.conf;