infrastructure/roles/hedgedoc/templates/nginx.d.conf.j2

upstream hedgedoc {
    server localhost:3000;
}

map $http_upgrade $connection_upgrade {
        default upgrade;
        ''      close;
}

server {
    listen       80;
    listen       [::]:80;
    server_name  {{ hedgedoc_domain }};

    access_log   /var/log/nginx/{{ hedgedoc_domain }}/access.log main;
    access_log   /var/log/nginx/{{ hedgedoc_domain }}/access.log.json json_main;
    error_log    /var/log/nginx/{{ hedgedoc_domain }}/error.log;

    include snippets/letsencrypt.conf;

    location / {
        return 301 https://$server_name$request_uri;
    }
}

server {
    listen       443 ssl http2;
    listen       [::]:443 ssl http2;
    server_name  {{ hedgedoc_domain }};

    access_log   /var/log/nginx/{{ hedgedoc_domain }}/access.log main;
    access_log   /var/log/nginx/{{ hedgedoc_domain }}/access.log.json json_main;
    error_log    /var/log/nginx/{{ hedgedoc_domain }}/error.log;

    ssl_certificate      /etc/letsencrypt/live/{{ hedgedoc_domain }}/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/{{ hedgedoc_domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ hedgedoc_domain }}/chain.pem;

{% set proxy -%}
        proxy_pass http://hedgedoc;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
{%- endset %}

    location / {
        {{ proxy }}
    }

    location = /status {
        return 403;
    }

    location = /metrics {
        if ($http_authorization != "Bearer {{ vault_hedgedoc_metrics_token }}") {
            return 403;
        }
        {{ proxy }}
    }

    location /socket.io/ {
        {{ proxy }}
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
   }
}