# Include in the existing nginx HTTP context. Install ONLY if nginx already owns 80/443.
server {
    listen 80;
    server_name random.ochenstarik.ru;
    location ^~ /.well-known/acme-challenge/ { root /var/www/randomayzer-acme; }
    location / { return 301 https://random.ochenstarik.ru$request_uri; }
}
server {
    listen 443 ssl;
    server_name random.ochenstarik.ru;
    ssl_certificate /etc/letsencrypt/live/random.ochenstarik.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/random.ochenstarik.ru/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    auth_basic "Randomayzer owner";
    auth_basic_user_file /etc/nginx/randomayzer.htpasswd;
    client_max_body_size 1m;
    client_body_timeout 20s;
    # OAuth callback has query credentials: never log request paths/query strings.
    access_log off;
    error_log /var/log/nginx/randomayzer-error.log crit;
    location / {
        proxy_pass http://10.77.0.3:3100;
        proxy_bind 10.77.0.1;
        proxy_set_header Host random.ochenstarik.ru;
        proxy_set_header X-Forwarded-Host random.ochenstarik.ru;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Real-IP "";
        proxy_set_header Forwarded "";
        proxy_set_header CF-Connecting-IP "";
        # Basic credentials are for nginx only, never forward them to the application.
        proxy_set_header Authorization "";
        proxy_connect_timeout 10s;
        proxy_read_timeout 120s;
        proxy_send_timeout 120s;
    }
}