#
# An nginx configuration that terminates SSL, acts as a reverse proxy for HAS,
# and passes the Authorization header to HAS for the /scim/v2 path.
#

events {
}

http {
    upstream backend {
        ip_hash;
        server auth-svc1.doc:3001;
    }

    server {
        listen 443 ssl;
        ssl_certificate /etc/nginx/ssl/mysite.crt;
        ssl_certificate_key /etc/nginx/ssl/mysite.key;
        location / {
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Forwarded-Proto https;
            proxy_pass http://backend;
            # Set a timeout longer than the service's own timeout period,
            # otherwise nginx will return a 504 instead of the expected 408.
            proxy_read_timeout 75s;
        }

        location /scim/v2 {
            proxy_set_header Authorization $http_authorization;
            proxy_pass_header Authorization;
            proxy_pass http://backend;
        }
    }
}
