nginx.conf.erb

daemon off;
# Heroku dynos have at least 4 cores.
worker_processes <%= ENV['NGINX_WORKERS'] || 4 %>;

events {
	use epoll;
	accept_mutex on;
	worker_connections <%= ENV['NGINX_WORKER_CONNECTIONS'] || 1024 %>;
}

http {
	gzip on;
	gzip_comp_level 2;
	gzip_min_length 512;
	gzip_proxied any; # Heroku router sends Via header

	server_tokens off;

	log_format l2met 'measure#nginx.service=$request_time request_id=$http_x_request_id';
	access_log <%= ENV['NGINX_ACCESS_LOG_PATH'] || 'logs/nginx/access.log' %> l2met;
	error_log <%= ENV['NGINX_ERROR_LOG_PATH'] || 'logs/nginx/error.log' %>;

	include mime.types;
	default_type application/octet-stream;
	sendfile on;

	resolver 1.1.1.1 valid=10s;

	# Must read the body in 5 seconds.
	client_body_timeout 5;

	upstream app_server {
		server unix:/tmp/nginx.socket fail_timeout=0;
	}

	server {
		listen <%= ENV["PORT"] %>;
		server_name _;
		keepalive_timeout 5;

		<% if ENV["EXTERNAL_AUTHENTICATION_URL"] %>
		location = /_external-authentication-check {
			internal;

			set $external_auth_url <%= ENV["EXTERNAL_AUTHENTICATION_URL"] %>/;
			client_max_body_size                        200m;
			proxy_set_header X-Forwarded-For            $proxy_add_x_forwarded_for;
			proxy_set_header Content-Length             "";
			proxy_pass_request_body                     off;

			proxy_pass                                  $external_auth_url;
		}

		location /_external-authentication-Sp {
			internal;

			set $external_auth_url <%= ENV["EXTERNAL_AUTHENTICATION_URL"] %>;
			proxy_set_header X-Initial-Request          $scheme://$host$request_uri;
			proxy_set_header X-Forwarded-For            $proxy_add_x_forwarded_for;

			proxy_pass                                  $external_auth_url;
		}
		<% end %>

		location / {
			<% if ENV["EXTERNAL_AUTHENTICATION_URL"] %>
			auth_request /_external-authentication-check;
			error_page 401 = /_external-authentication-Sp;
			<% end %>

			if ($http_x_forwarded_proto != "https") {
				return 301 https://$host$request_uri;
			}

			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header Host $http_host;
			proxy_redirect off;
			proxy_pass http://app_server;
		}
	}
}