mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-29 18:36:30 +02:00
64 lines
1.5 KiB
Text
64 lines
1.5 KiB
Text
set $pass_access_scheme $scheme;
|
|
|
|
set $pass_server_port $server_port;
|
|
|
|
set $best_http_host $http_host;
|
|
set $pass_port $pass_server_port;
|
|
|
|
set $proxy_alternative_upstream_name "";
|
|
|
|
client_max_body_size 1m;
|
|
|
|
|
|
proxy_set_header Host $best_http_host;
|
|
|
|
# Pass the extracted client certificate to the backend
|
|
|
|
# Allow websocket connections
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
|
|
proxy_set_header Connection "";
|
|
|
|
# uncomment to emulate nginx-ingress
|
|
# set_escape_uri $escaped_request_uri $request_uri;
|
|
|
|
# proxy_set_header X-Request-ID $req_id;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
proxy_set_header X-Forwarded-Host $best_http_host;
|
|
proxy_set_header X-Forwarded-Port $pass_port;
|
|
proxy_set_header X-Forwarded-Proto $pass_access_scheme;
|
|
|
|
proxy_set_header X-Scheme $pass_access_scheme;
|
|
|
|
# Pass the original X-Forwarded-For
|
|
proxy_set_header X-Original-Forwarded-For $http_x_forwarded_for;
|
|
|
|
# mitigate HTTPoxy Vulnerability
|
|
# https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
|
|
proxy_set_header Proxy "";
|
|
|
|
# Custom headers to proxied server
|
|
|
|
proxy_connect_timeout 5s;
|
|
proxy_send_timeout 60s;
|
|
proxy_read_timeout 60s;
|
|
|
|
proxy_buffering off;
|
|
proxy_buffer_size 4k;
|
|
proxy_buffers 4 4k;
|
|
|
|
proxy_max_temp_file_size 1024m;
|
|
|
|
proxy_request_buffering on;
|
|
proxy_http_version 1.1;
|
|
|
|
proxy_cookie_domain off;
|
|
proxy_cookie_path off;
|
|
|
|
# In case of errors try the next upstream server before returning an error
|
|
proxy_next_upstream error timeout;
|
|
proxy_next_upstream_timeout 0;
|
|
proxy_next_upstream_tries 3;
|
|
|
|
proxy_redirect off;
|