server_tokens off;

map $http_sec_websocket_key $http_upgrade {
    "" "";
    default "websocket";
}

map $http_sec_websocket_key $connection_upgrade {
    "" $http_connection;
    default "upgrade";
}

{{ NETWORK_DOCKER_DNS_NGINX_DIRECTIVE }}

server {
    listen 80;
    server_name _;

    # Exception: strip client-supplied Remote-User; otherwise a client could spoof it past the oauth2-proxy hop that sets it below.
    proxy_set_header Remote-User "";

    client_max_body_size 64m;
    proxy_read_timeout    300s;
    proxy_send_timeout    300s;

    location / {
        proxy_set_header Host                $host;
        proxy_set_header X-Real-IP           $remote_addr;
        proxy_set_header X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto   $scheme;
        proxy_set_header X-Forwarded-User    $http_x_forwarded_user;
        proxy_set_header Remote-User         $http_x_forwarded_user;
        proxy_set_header Upgrade             $http_upgrade;
        proxy_set_header Connection          $connection_upgrade;
        proxy_http_version 1.1;
        set $upstream_kix_frontend http://{{ KIX_FRONTEND_SERVICE }}:{{ KIX_FRONTEND_INTERNAL_PORT }};
        proxy_pass $upstream_kix_frontend;
    }
}