nginx-ssl.conf

user                www-data;
worker_processes    5;
error_log           /var/log/nginx/error.log;

events {
  worker_connections  4096;
}

http {
  include  mime.types;
  index    index.html index.htm;

  log_format   main '$remote_addr - $remote_user [$time_local]  $status '
    '"$request" $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';
  access_log   /var/log/nginx/access.log main;

  ssl_certificate     /etc/nginx/ssl/catalyst-soar.com.cer;
  ssl_certificate_key /etc/nginx/ssl/catalyst-soar.com.key;
  ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers         HIGH:!aNULL:!MD5;

  server {
    listen 80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
  }

  server {
    listen       443 ssl default_server;
    server_name _;

    client_max_body_size 0;
    proxy_buffering off;

    location / {
      resolver        127.0.0.11 valid=30s;
      set             $upstream_catalyst catalyst;
      proxy_pass      http://$upstream_catalyst:8000;
    }

    location /wss {
      resolver        127.0.0.11 valid=30s;
      set             $upstream_catalyst catalyst;
      proxy_pass      http://$upstream_catalyst:8000;

      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_read_timeout 86400;
    }
  }

  server {
    listen       8529 ssl default_server;
    server_name _;

    location / {
      resolver        127.0.0.11 valid=30s;
      set             $upstream_arangodb arangodb;
      proxy_pass      http://$upstream_arangodb:8529;
    }
  }

  server {
    listen       9000 ssl default_server;
    server_name _;

    # To allow special characters in headers
    ignore_invalid_headers off;
    # Allow any size file to be uploaded.
    # Set to a value such as 1000m; to restrict file size to a specific value
    client_max_body_size 0;
    # To disable buffering
    proxy_buffering off;

    location / {
      resolver        127.0.0.11 valid=30s;
      set             $upstream_minio minio;
      proxy_pass      http://$upstream_minio:9000;

      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header Host $http_host;

      # Default is HTTP/1, keepalive is only enabled in HTTP/1.1
      proxy_http_version 1.1;
      proxy_set_header Connection "";
      chunked_transfer_encoding off;
    }
  }

  server {
    listen       9002 ssl default_server;
    server_name _;

    location / {
      resolver        127.0.0.11 valid=30s;
      set             $upstream_keycloak keycloak;
      proxy_pass      http://$upstream_keycloak:8080;
      proxy_set_header Host               $host;
      proxy_set_header X-Real-IP          $remote_addr;
      proxy_set_header X-Forwarded-Proto  $scheme;
      proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Port   $server_port;
      proxy_set_header X-Forwarded-Host   $host;
      proxy_set_header X-Forwarded-Server $host;
    }
  }
}