nginx_default_config.conf

events { }


http {
    proxy_buffers 32 160k;  
    proxy_buffer_size 160k;
    proxy_read_timeout 3600;
    error_log /dev/stdout info;
    access_log /dev/stdout;

    map $http_authorization $auth {
       default   $http_authorization;
       ""        $token;
    }

    map "" $edge_hub_endpoint {
       default  https://edgehub;
       ""       https://edgehub;
    }

    proxy_cache_path /var/cache/nginx levels=1 keys_zone=token_cache:1m max_size=2m
                 inactive=60m use_temp_path=off;

    server {
        listen ${NGINX_DEFAULT_PORT} ssl default_server;

        chunked_transfer_encoding on;

        ssl_protocols ${NGINX_DEFAULT_TLS};

        #if_tag ${NGINX_DEFAULT_CIPHERS}
        ssl_ciphers ${NGINX_DEFAULT_CIPHERS};
        #endif_tag ${NGINX_DEFAULT_CIPHERS}

        ssl_certificate        server.crt;
        ssl_certificate_key    private_key_server.pem; 
        ssl_client_certificate trustedCA.crt;
        ssl_verify_depth 7;
        ssl_verify_client optional_no_ca;

        #if_tag ${BLOB_UPLOAD_ROUTE_ADDRESS}
        if ($http_x_ms_version)
        {
            rewrite ^(.*)$ /storage$1 last;
        }
        #endif_tag ${BLOB_UPLOAD_ROUTE_ADDRESS} 
        #if_tag boolean_expression[!(${BLOB_UPLOAD_ROUTE_ADDRESS})]
        if ($http_x_ms_version)
        {
            rewrite ^(.*)$ /parent$1 last;
        }
        #endif_tag boolean_expression[!(${BLOB_UPLOAD_ROUTE_ADDRESS})]          

        #if_tag ${DOCKER_REQUEST_ROUTE_ADDRESS}
        if ($uri ~ ^/v2*.)
        {
            rewrite ^(.*)$ /registry$1 last;
        }
        #endif_tag ${DOCKER_REQUEST_ROUTE_ADDRESS}
        #if_tag ${CONNECTED_ACR_ROUTE_ADDRESS}
        location /v2 {
            resolver 127.0.0.11;
            proxy_http_version 1.1;
            proxy_pass         http://${CONNECTED_ACR_ROUTE_ADDRESS};
            proxy_set_header   X-Forwarded-Host $http_host;
            proxy_set_header   X-Forwarded-Proto $scheme;
            client_max_body_size 1000G;
        }

        location /acr {
            resolver 127.0.0.11;
            proxy_http_version 1.1;
            proxy_pass         http://${CONNECTED_ACR_ROUTE_ADDRESS};
            proxy_set_header   X-Forwarded-Host $http_host;
            proxy_set_header   X-Forwarded-Proto $scheme;
            client_max_body_size 1000G;
        }
        #endif_tag ${CONNECTED_ACR_ROUTE_ADDRESS} 
        #if_tag boolean_expression[&(!(${DOCKER_REQUEST_ROUTE_ADDRESS}),!(${CONNECTED_ACR_ROUTE_ADDRESS}))]
        if ($uri ~ ^/v2*.)
        {
            rewrite ^(.*)$ /parent$1 last;
        }
        #endif_tag boolean_expression[&(!(${DOCKER_REQUEST_ROUTE_ADDRESS}),!(${CONNECTED_ACR_ROUTE_ADDRESS}))]      

        #if_tag ${DOCKER_REQUEST_ROUTE_ADDRESS}
        location ~^/registry/(.*) {
            proxy_http_version 1.1;
            resolver 127.0.0.11;
            set $endpoint http://${DOCKER_REQUEST_ROUTE_ADDRESS}$request_uri;
            proxy_pass $endpoint;
        }
        #endif_tag ${DOCKER_REQUEST_ROUTE_ADDRESS}

        #if_tag ${BLOB_UPLOAD_ROUTE_ADDRESS}
        location ~^/storage/(.*){
            resolver 127.0.0.11;
            proxy_http_version 1.1;
            set $endpoint http://${BLOB_UPLOAD_ROUTE_ADDRESS}$request_uri;
            proxy_pass $endpoint;
        }
        #endif_tag ${BLOB_UPLOAD_ROUTE_ADDRESS}        

        #if_tag ${IOTEDGE_PARENTHOSTNAME}      
        location ~^/parent/(.*) {
            proxy_http_version 1.1;
            resolver 127.0.0.11;
            #proxy_ssl_certificate     identity.crt;
            #proxy_ssl_certificate_key private_key_identity.pem;
            proxy_ssl_server_name on;
            proxy_ssl_name  ${IOTEDGE_MODULEID};
            proxy_ssl_trusted_certificate trustedCA.crt;
            proxy_ssl_verify_depth 7;
            proxy_ssl_verify       on;
            proxy_pass          https://${IOTEDGE_PARENTHOSTNAME}:${NGINX_DEFAULT_PORT}$request_uri;
        }
        #endif_tag ${IOTEDGE_PARENTHOSTNAME}

        location ~^/devices|twins/ {
            auth_request /auth;
            auth_request_set $token $upstream_http_x_token;
            resolver 127.0.0.11;
            proxy_http_version  1.1;
            proxy_ssl_verify    off;
            proxy_set_header    x-ms-edge-clientcert    $ssl_client_escaped_cert; 
            proxy_set_header    Authorization $auth;          
            proxy_pass $edge_hub_endpoint;
        }

        location ~^/.iothub/websocket {
            auth_request /auth;
            auth_request_set $token $upstream_http_x_token;
            resolver 127.0.0.11;
            proxy_ssl_verify off;
            proxy_set_header x-ms-edge-clientcert $ssl_client_escaped_cert;
            proxy_set_header    Authorization $auth;             
            proxy_pass $edge_hub_endpoint;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "Upgrade";
            proxy_set_header Host $host;
        }

        location = /auth {
            internal;
            proxy_cache token_cache;
            proxy_cache_valid any ${TOKEN_VALIDITY_MINUTES}m;
            proxy_cache_key         "token";  
            proxy_http_version 1.1;
            resolver 127.0.0.11;
            set $endpoint http://127.0.0.1:${TOKEN_SERVER_PORT};
            proxy_pass $endpoint;
        }                
    }
}