{# input variables ~ examples:
- acme_challenge_location ~ /ssl/:
- resolver ~ 127.0.0.11:
- servers
    - name ~ doma.in,
    - all_names ~ doma.in testing.doma.in
    - proxy_pass ~ http://localhost:3333
    - certificate_dir ~ other.doma.in
    - server_options
        - opt_1;
        ...
    - location_options
        - opt_1;
        ...  
    - http_port ~ 80
    - https_port ~ 443
    - https_custom_params ~ http2
-#}

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;
    server_tokens off;
    gzip on;

    proxy_connect_timeout 300;
    proxy_send_timeout 600;
    proxy_read_timeout 600;
    send_timeout 600;
    client_max_body_size 500M;

    server {
        return 404;
    }

    {%- for server in servers %}
    {# #}
    server {
        listen              {{ server["http_port"] }};
        {%- if server["certificate_dir"] is not none %}
        listen              {{ server["https_port"] }} ssl {{- "" if server["ssl_custom_params"]|length == 0 else " " + server["ssl_custom_params"]}};
        ssl_certificate     {{ server["certificate_dir"] }}/fullchain.pem;
        ssl_certificate_key {{ server["certificate_dir"] }}/privkey.pem;

        if ($scheme = 'http') {
            return 302 https://$host$request_uri;
        }
        {%- endif %}
        keepalive_timeout   70;

        server_name         {{ server["all_names"] or server["name"] }};

        {%- if acme_challenge_location is not none %}
        {# #}
        location /.well-known/acme-challenge {
            root {{ acme_challenge_location }};
        }
        {%- endif %}

        {%- if server["server_options"]|length > 0 %}
        {# #}
        {%- for server_option in server["server_options"] %}
        {{ server_option }}
        {%- endfor %}
        {%- endif %}

        {%- if server["proxy_pass"] is not none %}
        {# #}
        location / {
            resolver {{ resolver }};
            set $host_{{ loop.index }} {{ server["proxy_pass"] }};
            proxy_pass $host_{{ loop.index }};

            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Real-IP $remote_addr;

            {%- if server["location_options"]|length > 0 %}
            {# #}
            {%- for location_option in server["location_options"] %}
            {{ location_option }}
            {%- endfor %}
            {%- endif %}
        }
        {%- endif %}
    }
    {%- endfor %}
}