nginx.conf

### for more information
# error_log ~/Library/Logs/Homebrew/nginx/error.log info;

events {
    worker_connections  1024;
}

http {

  server {
    # entry point for clients
    listen 8400-8500 ssl;
    client_body_buffer_size 10M;

    # TLS
    ssl_certificate       /Users/nferc/Workspace/gematik/ePa_av-gate/cert/server.cert;
    ssl_certificate_key   /Users/nferc/Workspace/gematik/ePa_av-gate/cert/server.key;

    # mTLS
    ssl_client_certificate  /Users/nferc/Workspace/gematik/ePa_av-gate/cert/ca-cert.pem;
    ssl_verify_client on;

    # only pass PHRService and connector.sds to av-gate
    # location ~ /(PHRService|connector.sds) {
    location / {
      proxy_redirect off;

      ### uwsgi preferred
      include docker/uwsgi_params;
      uwsgi_param HTTP_X_REAL_IP $remote_addr;
      uwsgi_param HTTP_X_CLIENT_CERT $ssl_client_s_dn;
      uwsgi_pass localhost:8080;

      ### Fallback for no uwsgi (dev only)
      # include /opt/homebrew/etc/nginx/uwsgi_params;
      # proxy_set_header X-real-ip $remote_addr;
      # proxy_set_header host $server_addr:$server_port;
      # proxy_pass "http://127.0.0.1:5001";
    }

    # bypass other services to connector (optional)
    # only neccessary for av_proxy.ini/[konnektor]/proxy_all_services = true
    # this reduce workload for av-gate dramatically and should be used when proxy_all_services is set.
    # you have to set the location for the previous section to "~ ^/(ws/PHRService|connector.sds)"

    # location / {
    #   proxy_ssl_certificate       /Users/nferc/Workspace/gematik/ePa_av-gate/cert/kclient.cert;
    #   proxy_ssl_certificate_key   /Users/nferc/Workspace/gematik/ePa_av-gate/cert/kclient.key;
    #   proxy_ssl_server_name on;
    #   proxy_pass "https://kon-instanz1.titus.gematik.solutions";

    # if you have multiple certificates, you must split the config for each port and connector

    # }
  }

  # separate endpoint for health, check without ssl and m-tls
  server {
    listen 8300;
    location ~ ^/(health|check|icap)$ {
      proxy_redirect off;
      uwsgi_param HTTP_X_REAL_IP $remote_addr;
      include docker/uwsgi_params;
      uwsgi_pass localhost:8080;
    }
  }
}


# forward ldap(s)

# stream {
#   server {
#     listen 389;
#     listen 636;
#     proxy_pass ${KONNEKTOR_HOST}:$server_port;
#   }
#   server {
#     listen 389 udp;
#     listen 636 udp;
#     proxy_pass ${KONNEKTOR_HOST}:$server_port;
#     proxy_responses 1;
#   }
# }