ssl-nginx/nginx/nginx.conf.j2

{#- variables ~ examples: #}
{#-  acme_challenge_location ~ /ssl/: #}
{#-  resolver ~ 127.0.0.11: #}
{#-  servers ~ ["name": ..., ("redirect": ..., "server_options": ..., "location_options": ..., "all_names": ..., "port": ..., "ssl_port": ...)]: #}
{#- #}user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;
    server_tokens off;
    gzip on;

    proxy_connect_timeout 300;
    proxy_send_timeout 600;
    proxy_read_timeout 600;
    send_timeout 600;
    client_max_body_size 500M;

    server {
        return 404;
    }

    {%- for server in servers %}
    server {
        listen              {{ server["port"] or 80 }};
        {%- if server["certificate_dir"] is not none %}
        listen              {{ server["ssl_port"] or 443 }} ssl;
        {%- endif %}
        keepalive_timeout   70;

        server_name         {{ server["all_names"] or server["name"] }};

        {%- if acme_challenge_location is defined %}
        {# #}
        location /.well-known/acme-challenge {
            root {{ acme_challenge_location }};
        }
        {%- endif %}

        {%- if server["server_options"]|length > 0 %}
        {# #}
        {%- for server_option in server["server_options"] %}
        {{ server_option }}
        {%- endfor %}
        {%- endif %}

        {%- if server["certificate_dir"] is not none %}
        {# #}
        ssl_certificate     {{ server["certificate_dir"] }}/fullchain.pem;
        ssl_certificate_key {{ server["certificate_dir"] }}/privkey.pem;
        {%- endif %}

        {%- if server["redirect"] is not none %}
        {# #}
        location / {
            resolver {{ resolver }};
            set $host_{{ loop.index }} {{ server["redirect"] }};
            proxy_pass $host_{{ loop.index }};

            proxy_set_header Host $host:$server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Real-IP $remote_addr;

            {%- if server["location_options"]|length > 0 %}
            {# #}
            {%- for location_option in server["location_options"] %}
            {{ location_option }}
            {%- endfor %}
            {%- endif %}
        }
        {%- endif %}
    }
    {%- endfor %}
}