nginx.conf

events {}

http {
  server {
    listen 80;
    proxy_buffers 4 512k;
    proxy_buffer_size 256k;
    # Need to specify a DNS resolver because we are using variables to
    # specify the proxy_pass hostnames. This approach is useful because it
    # allows nginx to start if the referenced endpoints are unobtainable
    # - instead they are checked at runtime, hence the resolver requirement.
    #
    # This is the internal Docker DNS, cache only for 30s
    # IMPORTANT: If using docker-compose with reliance upon internal DNS lookups
    # between services, then use this...
    resolver 127.0.0.11 valid=30s;
    #
    # Or google...
    # resolver 8.8.8.8;

    # the protected resource we are trying to reach
    location /ades {
      auth_request /authcheck;
      set $protected_address ades;
      proxy_pass http://$protected_address/;
      auth_request_set $pep_special_header $upstream_http_x_pep_special_header;
      proxy_set_header "X-Pep-Special-Header" $pep_special_header;
    }

    # the endpoint for performing auth checks
    location /authcheck {
      internal;
      set $pep_address pep;
      proxy_pass http://$pep_address/;
      proxy_pass_request_body off;
      proxy_set_header Content-Length "";
      proxy_set_header X-Original-URI $request_uri;
      proxy_set_header X-Original-Method $request_method;
    }

    location / {
       proxy_pass http://gatekeeper:3000/;
       proxy_set_header Host $host;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Scheme $scheme;
       proxy_set_header X-Forwarded-Host $host:80;
       proxy_set_header X-Forwarded-Port 80;
       proxy_set_header X-Forwarded-Server $host;
       proxy_set_header X-Forwarded-Proto $scheme;
       proxy_connect_timeout 1;
       proxy_read_timeout 30;
       proxy_send_timeout 30;
       proxy_http_version 1.1;
    }
  }
}