server {
     
       #content redacted
        {{/* Listen on 442 because port 443 is used in the TLS sni server */}}
        {{/* This listener must always have proxy_protocol enabled, because the SNI listener forwards on source IP info in it. */}}
        {{ if not (empty $server.SSLCertificate) }}listen 442 proxy_protocol{{ if eq $server.Hostname "_"}} default_server reuseport backlog={{ $backlogSize }}{{end}} ssl {{ if $cfg.UseHTTP2 }}http2{{ end }};

    }

    # filter numeric values so that we don't generate invalid json
    map $request_time $request_time_numeric {
      ~^(([0-9]*)|(([0-9]*)\.([0-9]*)))$ $request_time;
      default                            null;
    }

    map $request_length $request_length_numeric {
      ~^(([0-9]*)|(([0-9]*)\.([0-9]*)))$ $request_length;
      default                            null;
    }

    map $body_bytes_sent $body_bytes_sent_numeric {
      ~^(([0-9]*)|(([0-9]*)\.([0-9]*)))$ $body_bytes_sent;
      default                            null;
    }

    map $upstream_response_length $upstream_response_length_numeric {
      ~^(([0-9]*)|(([0-9]*)\.([0-9]*)))$ $upstream_response_length;
      default                            null;
    }

    map $upstream_response_time $upstream_response_time_numeric {
      ~^(([0-9]*)|(([0-9]*)\.([0-9]*)))$ $upstream_response_time;
      default                            null;
    }

    log_format json '{ '
         '"level": "info", '
         '"timestamp": "$time_iso8601", '
         '"message": "$status $request", '
         '"remote_addr": "{{ if $cfg.UseProxyProtocol }}$proxy_protocol_addr{{ else }}$remote_addr{{ end }}", '
         '"proxy_forwarded_for": "$http_x_forwarded_for", '
         '"remote_user": "$remote_user", '
         '"status": "$status", '
         '"request_method": "$request_method", '
         '"http_host": "$host", '
         '"http_protocol": "$pass_access_scheme", '
         '"request": "$request", '
         '"request_length": $request_length_numeric, '
         '"request_time": $request_time_numeric, '
         '"body_bytes_sent": $body_bytes_sent_numeric, '
         '"proxy_upstream_name": "$proxy_upstream_name", '
         '"upstream_addr": "$upstream_addr", '
         '"upstream_response_length": $upstream_response_length_numeric, '
         '"upstream_response_time": $upstream_response_time_numeric, '
         '"upstream_status": "$upstream_status", '
         '"http_referrer": "$http_referer", '
         '"http_user_agent": "$http_user_agent" '
    '}';

    {{/* map urls that should not appear in access.log */}}
    {{/* http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log */}}
    map $request_uri $loggable {
        {{ range $reqUri := $cfg.SkipAccessLogURLs }}
        {{ $reqUri }} 0;{{ end }}
        default 1;
    }

    {{ if $cfg.DisableAccessLog }}
    access_log off;
    {{ else }}
    access_log /var/log/nginx/access.log json if=$loggable;
    {{ end }}
    error_log  /var/log/nginx/error.log {{ $cfg.ErrorLogLevel }};

server {
    server_name echo.api.blue;
    listen 80;
    listen [::]:80;

    listen 442 proxy_protocol ssl http2;
    listen [::]:442 proxy_protocol  ssl http2;
    # PEM sha: 51318bfe15fceda4de78851efdb08d4e6f191aaf
    ssl_certificate                         /ingress-controller/ssl/default-echoserver-tls.pem;
    ssl_certificate_key                     /ingress-controller/ssl/default-echoserver-tls.pem;

    more_set_headers                        "Strict-Transport-Security: max-age=15724800; includeSubDomains;";

    vhost_traffic_status_filter_by_set_key $geoip_country_code country::$server_name;

    location /.well-known/acme-challenge {
        set $proxy_upstream_name "default-kube-lego-nginx-8080";
        port_in_redirect off;

        client_max_body_size                    "2g";

        proxy_set_header Host                   $best_http_host;

        # Pass the extracted client certificate to the backend

        # Pass Real IP
        proxy_set_header X-Real-IP              $remote_addr;

        # Allow websocket connections
        proxy_set_header                        Upgrade           $http_upgrade;
        proxy_set_header                        Connection        $connection_upgrade;

        proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host       $best_http_host;
        proxy_set_header X-Forwarded-Port       $pass_port;
        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
        proxy_set_header X-Original-URI         $request_uri;
        proxy_set_header X-Scheme               $pass_access_scheme;

        # mitigate HTTPoxy Vulnerability
        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
        proxy_set_header Proxy                  "";

        # Custom headers

        proxy_connect_timeout                   5s;
        proxy_send_timeout                      300s;
        proxy_read_timeout                      300s;

        proxy_redirect                          off;
        proxy_buffering                         off;
        proxy_buffer_size                       "4k";
        proxy_buffers                           4 "4k";

        proxy_http_version                      1.1;

        proxy_cookie_domain                     off;
        proxy_cookie_path                       off;

        proxy_pass http://default-kube-lego-nginx-8080;
    }
    # enforce ssl on server side
    if ($pass_access_scheme = http) {
        return 301 https://$best_http_host$request_uri;
    }
    location / {
        set $proxy_upstream_name "default-echoserver-svc-9993";
        port_in_redirect off;

        client_max_body_size                    "2g";

        proxy_set_header Host                   $best_http_host;

        # Pass the extracted client certificate to the backend

        # Pass Real IP
        proxy_set_header X-Real-IP              $remote_addr;

        # Allow websocket connections
        proxy_set_header                        Upgrade           $http_upgrade;
        proxy_set_header                        Connection        $connection_upgrade;

        proxy_set_header X-Forwarded-For        $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host       $best_http_host;
        proxy_set_header X-Forwarded-Port       $pass_port;
        proxy_set_header X-Forwarded-Proto      $pass_access_scheme;
        proxy_set_header X-Original-URI         $request_uri;
        proxy_set_header X-Scheme               $pass_access_scheme;

        # mitigate HTTPoxy Vulnerability
        # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
        proxy_set_header Proxy                  "";

        # Custom headers

        proxy_connect_timeout                   5s;
        proxy_send_timeout                      300s;
        proxy_read_timeout                      300s;

        proxy_redirect                          off;
        proxy_buffering                         off;
        proxy_buffer_size                       "4k";
        proxy_buffers                           4 "4k";

        proxy_http_version                      1.1;

        proxy_cookie_domain                     off;
        proxy_cookie_path                       off;

        proxy_pass http://default-echoserver-svc-9993;
    }

}

# Pass Real IP

set $the_real_ip $remote_addr;
set $the_x_forwarded_for $proxy_add_x_forwarded_for;

if ($pass_access_scheme = 'https') {
    set $the_real_ip $proxy_protocol_addr;
    set $the_x_forwarded_for $proxy_protocol_addr;
}

proxy_set_header X-Real-IP              $the_real_ip;
proxy_set_header X-Forwarded-For        $the_x_forwarded_for;