upstream @backoffices {
    server 127.0.0.1:9000 max_fails=250 fail_timeout=60s;
    server 127.0.0.1:9001 max_fails=250 fail_timeout=60s;
    server 127.0.0.1:9002 max_fails=250 fail_timeout=60s;
    server 127.0.0.1:9003 max_fails=250 fail_timeout=60s;
    server 127.0.0.1:9004 max_fails=250 fail_timeout=60s;
    server 127.0.0.1:9005 max_fails=250 fail_timeout=60s;
    server 127.0.0.1:9006 max_fails=250 fail_timeout=60s;
    server 127.0.0.1:9007 max_fails=250 fail_timeout=60s;
    keepalive 64;
}

server {
    listen 80;
    server_name admin.domain.tld;
    rewrite ^(.*) https://$server_name$request_uri? permanent;
    location ~ (.*)$ {
        deny all;
    }
    access_log /dev/null;
    # error_log /dev/null crit;
}

server {
    listen 443 default ssl;
    server_name admin.domain.tld;
    
    ssl on;
    ssl_certificate /data/ssl/server.crt;
    ssl_certificate_key /data/ssl/server.key;
    
    rewrite ^(.*) https://$server_name$request_uri? permanent;
    limit_conn conn_limit_per_ip 10;
    limit_req zone=req_limit_per_ip burst=5 nodelay;

    if ($request_method !~ ^(GET|POST)$ ){
        return 405;
    }

    include /data/etc/nginx/errors.conf;
    include /data/etc/nginx/common.conf;

    location / {
        proxy_redirect off;
        proxy_pass_header Server;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Scheme $scheme;
        proxy_set_header X-NginX-Proxy true;
        proxy_set_header X-Frame-Options "DENY";
        proxy_set_header Connection "";
        proxy_http_version 1.1;
        proxy_connect_timeout 10;
        proxy_read_timeout 10;
        proxy_pass http://@backoffices;
    }
    
    try_files $uri /maintenance.html @backoffices;
    access_log /dev/null;
    # error_log /dev/null crit;
}
