infrastructure/roles/matrix/templates/nginx.d.conf.j2

{% for config in matrix_nginx_config %}
upstream matrix_{{ config.name }} {
    server 127.0.0.1:{{ config.port }};
}

{% endfor %}
server {
    listen       80;
    listen       [::]:80;
    server_name  {{ matrix_domain }};

    access_log   /var/log/nginx/{{ matrix_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ matrix_domain }}/access.log.json json_reduced;
    error_log    /var/log/nginx/{{ matrix_domain }}/error.log;

    include snippets/letsencrypt.conf;

    location / {
        access_log off;
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  {{ matrix_domain }};

    access_log   /var/log/nginx/{{ matrix_domain }}/access.log reduced;
    access_log   /var/log/nginx/{{ matrix_domain }}/access.log.json json_reduced;
    error_log    /var/log/nginx/{{ matrix_domain }}/error.log;

    ssl_certificate         /etc/letsencrypt/live/{{ matrix_domain }}/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/{{ matrix_domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ matrix_domain }}/chain.pem;

{% for config in matrix_nginx_config %}
    # {{ config.name }}
{% for location in config.locations %}
{% if location is string %}
{% set location = { 'path': location } %}
{% endif %}
    location {{ location.path }} {
        access_log /var/log/nginx/{{ matrix_domain }}/access.log main;
        access_log /var/log/nginx/{{ matrix_domain }}/access.log.json json_main;
{% if location.add_cors | default(false) %}
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods "GET, HEAD, POST, PUT, DELETE, OPTIONS";
        add_header Access-Control-Allow-Headers "X-Requested-With, Content-Type, Authorization, Date";
{% endif %}
        proxy_pass http://matrix_{{ config.name }}{{ location.pass | default('') }};
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $host;
        proxy_read_timeout 900s;
        client_max_body_size {{ matrix_max_upload_size }};
    }
{% endfor %}

{% endfor %}
{% for ep in matrix_metrics_endpoints %}
    location = /metrics/{{ ep.name }} {
        if ($http_authorization != "Bearer {{ vault_matrix_metrics_token }}") {
            return 403;
        }
        proxy_pass http://127.0.0.1:{{ ep.port }}/{{ ep.path | default('') }};
    }

{% endfor %}
    location = /metrics {
        if ($http_authorization != "Bearer {{ vault_matrix_metrics_token }}") {
            return 403;
        }
        default_type text/plain;
        return 200 "Available endpoints:\n{% for ep in matrix_metrics_endpoints %}  /metrics/{{ ep.name }}\n{% endfor %}";
    }

    location = / {
        default_type text/plain;
        return 200 "Nothing to see here.";
    }

    location / {
        return 404;
    }
}