daemon off;
error_log stderr info;          # Yes, must be specified here _and_ cmdline
events {
}
http {
  access_log {{ACCESSLOG}} combined;
  upstream arv-git-http {
    server localhost:{{GITPORT}};
  }
  server {
    listen *:{{GITSSLPORT}} ssl default_server;
    server_name _;
    ssl_certificate {{SSLCERT}};
    ssl_certificate_key {{SSLKEY}};
    location  / {
      proxy_pass http://arv-git-http;
    }
  }
  upstream keepproxy {
    server localhost:{{KEEPPROXYPORT}};
  }
  server {
    listen *:{{KEEPPROXYSSLPORT}} ssl default_server;
    server_name _;
    ssl_certificate {{SSLCERT}};
    ssl_certificate_key {{SSLKEY}};
    location  / {
      proxy_pass http://keepproxy;
    }
  }
  upstream keep-web {
    server localhost:{{KEEPWEBPORT}};
  }
  server {
    listen *:{{KEEPWEBSSLPORT}} ssl default_server;
    server_name ~^(?<request_host>.*)$;
    ssl_certificate {{SSLCERT}};
    ssl_certificate_key {{SSLKEY}};
    location  / {
      proxy_pass http://keep-web;
      proxy_set_header Host $request_host:{{KEEPWEBPORT}};
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
  }
  server {
    listen *:{{KEEPWEBDLSSLPORT}} ssl default_server;
    server_name ~.*;
    ssl_certificate {{SSLCERT}};
    ssl_certificate_key {{SSLKEY}};
    location  / {
      proxy_pass http://keep-web;
      proxy_set_header Host download:{{KEEPWEBPORT}};
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_redirect //download:{{KEEPWEBPORT}}/ https://$host:{{KEEPWEBDLSSLPORT}}/;
    }
  }
  upstream ws {
    server localhost:{{WSPORT}};
  }
  server {
    listen *:{{WSSPORT}} ssl default_server;
    server_name ~^(?<request_host>.*)$;
    ssl_certificate {{SSLCERT}};
    ssl_certificate_key {{SSLKEY}};
    location  / {
      proxy_pass http://ws;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $request_host:{{WSPORT}};
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
  }
}