ansible-roles/webapps/etherpad/templates/vhost.conf.j2

map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      close;
}

server {
  listen 80;
  listen [::]:80;
  server_name {{ domains |first }};
  
  # For certbot
  include /etc/nginx/snippets/letsencrypt.conf;

  {% if ssl.stat.exists %}
  location / { return 301 https://$host$request_uri; }
  {% endif %}
}

{% if ssl.stat.exists %}
server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;
  
  server_name {{ domains |first }};

  access_log /var/log/nginx/{{ service }}.access.log;
  error_log  /var/log/nginx/{{ service }}.error.log;
  
  include /etc/nginx/snippets/letsencrypt.conf;
  include /etc/nginx/ssl/{{ domains | first }}.conf;

  location / {
    proxy_pass         http://127.0.0.1:{{ node_port }};
    proxy_buffering    off; # be careful, this line doesn't override any proxy_buffering on set in a conf.d/file.conf
    proxy_set_header   Host $host;
    proxy_pass_header  Server;

    # Note you might want to pass these headers etc too.
    proxy_set_header    X-Real-IP $remote_addr; # https://nginx.org/en/docs/http/ngx_http_proxy_module.html
    proxy_set_header    X-Forwarded-For $remote_addr; # EP logs to show the actual remote IP
    proxy_set_header    X-Forwarded-Proto $scheme; # for EP to set secure cookie flag when https is used
    proxy_http_version  1.1; # recommended with keepalive connections

    # WebSocket proxying - from https://nginx.org/en/docs/http/websocket.html
    proxy_set_header  Upgrade $http_upgrade;
    proxy_set_header  Connection $connection_upgrade;
  }  
}
{% endif %}