apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
data:
  default.conf: |
    upstream certbot {
      server certbot:8080 max_fails=0 fail_timeout=1s;
    }

    upstream hfg-server {
      server hfg-server:8090 max_fails=0 fail_timeout=1s;
    }

    upstream hfg-server-ssl {
      server hfg-server:8091 max_fails=0 fail_timeout=1s;
    }

    server {
      listen 80;
      listen [::]:80;
      server_name  hfg.hopto.org;

      location / {
        add_header Content-Type text/plain; # Prevents download
        return 200 "Hello certbot!";
      }

      # Redirect all traffic in /.well-known/ to certbot
      location ^~ /.well-known/acme-challenge/ {
        proxy_pass http://certbot;
      }
    }

    server {
      listen 8090;
      listen [::]:8090;
      server_name  hfg.hopto.org;

      location / {
        proxy_pass http://hfg-server;

        # WebSocket support
        proxy_http_version       1.1;
        proxy_set_header         Upgrade $http_upgrade;
        proxy_set_header         Connection "upgrade";
      }
    }

    server {
      listen 8091 ssl http2;
      listen [::]:8091 ssl http2;
      server_name  hfg.hopto.org;

      ssl_certificate            /etc/nginx/ssl/tls.crt;
      ssl_certificate_key        /etc/nginx/ssl/tls.key;

      ssl on;
      ssl_session_cache          builtin:1000 shared:SSL:10m;
      ssl_protocols              TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers                HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
      ssl_prefer_server_ciphers  on;

      location / {
        proxy_set_header         Host $host;
        proxy_set_header         X-Real-IP $remote_addr;
        proxy_set_header         X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header         X-Forwarded-Proto $scheme;
        proxy_read_timeout       90;

        proxy_pass http://hfg-server;

        # WebSocket support
        proxy_http_version       1.1;
        proxy_set_header         Upgrade $http_upgrade;
        proxy_set_header         Connection "upgrade";
      }
    }
