server {
    listen 80;
    server_name my.example.com;

    # See: https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mode
    # and  https://datatracker.ietf.org/doc/html/rfc8555
    location ~ ^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)$ {
      default_type text/plain;
      return 200 "$1.MY_ACCOUNT_THUMBPRINT_GOES_HERE";
    }

    location / {
      return 301 https://$host$request_uri;
    }
}

upstream geth-pool {
  server server-a:8545 max_fails=10 fail_timeout=2s;
  server server-c:8545 max_fails=10 fail_timeout=2s backup;
  server server-b:8545 max_fails=10 fail_timeout=2s backup;
  keepalive 200;
}

upstream reg-ui-pool {
  keepalive 2;
  server server-a:8085;
}

upstream reg-api-pool {
  keepalive 2;
  server server-a:8086;
}

# auth uses the reg server when available
upstream auth-pool {
  keepalive 10;
  server server-a:8080;
  server server-b:8080 backup;
  server server-c:8080 backup;
}


log_format upstreamlog '[$time_local] $msec $remote_addr $user_id - $server_name($host) to $upstream_addr: $request $status upstream_response_time $upstream_response_time request_time $request_time';
proxy_cache_path /var/cache/nginx/auth_cache levels=1 keys_zone=auth_cache:1m max_size=5m inactive=60m;

server {
    listen 443 ssl http2;
    server_name my.example.com;
    keepalive_requests 500000;
    keepalive_timeout 90s;
    http2_max_requests 5000000;
    http2_max_concurrent_streams 1024;
    http2_idle_timeout 3m;
    http2_recv_timeout 30s;
    access_log /var/log/nginx/my.example.com-access.log upstreamlog;
    error_log /var/log/nginx/my.example.com-error.log;

    ssl_certificate /etc/nginx/ssl/my.example.com/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/my.example.com/key.pem;
    ssl_session_cache shared:SSL:10m;

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root /usr/share/nginx/html;
    }

    #rewrite ^/?$ /newuser/;
    rewrite ^/?$ https://www.example.com/;

    # geth-pool ETH API
    location ~ ^/v1/eth/?([^/]*)$ {
        set $apiKey $1;
        if ($apiKey = '') {
          set $apiKey $http_X_API_KEY;
        }
        auth_request /auth;
        auth_request_set $user_id $sent_http_x_user_id;
        rewrite /.*$ / break;

        client_max_body_size       3m;
        client_body_buffer_size    3m;
        proxy_buffer_size          32k;
        proxy_buffers              16 32k;
        proxy_busy_buffers_size    96k;

        proxy_pass  http://geth-pool;
        proxy_set_header X-Original-Remote-Addr $remote_addr;
        proxy_set_header X-User-Id $user_id;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }

    # keycloak
    location = /auth {
        internal;
        proxy_cache auth_cache;
        proxy_cache_key "$apiKey";
        proxy_cache_valid 200 300s;
        proxy_cache_valid 401 30s;
        proxy_pass http://auth-pool/auth/realms/cerc/check?memberOf=eth&apiKey=$apiKey;
        proxy_pass_request_body off;
        proxy_set_header Content-Length "";
        proxy_set_header X-Original-URI $request_uri;
        proxy_set_header X-Original-Remote-Addr $remote_addr;
        proxy_set_header X-Original-Host $host;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }

    location /newuser/ {
        proxy_pass  http://reg-ui-pool/;
    }

    location /user-api/ {
        proxy_pass  http://reg-api-pool/;
    }
}