sample nginx config

nginx.conf

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for" '
                      '"$proxy_host" "$upstream_addr" ';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       80;
        listen       [::]:80;
        server_name  _;
        root         /usr/share/nginx/html;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

     return 301 https://$host$request_uri:8443;

        error_page 404 /404.html;
        location = /404.html {
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
        }
    }

    upstream notification-service {
      ip_hash;
      server 172.16.33.140:8090;
      server 172.16.33.141:8090;
    }
    
    upstream auth-service {
        ip_hash;
        server 172.16.33.140:8091;
        server 172.16.33.141:8091;
    }
	
    upstream cis-tomcat {
        ip_hash;
        server 172.16.33.140:8080;
    }

    upstream fundio-service {
        ip_hash;
        server 10.233.34.80:8093;
        server 10.233.34.81:8093;
    }
	
	upstream fundtrading-service {
        ip_hash;
        server 172.16.33.140:8094;
        server 172.16.33.141:8094;
    }


    upstream edda-webhook {
      ip_hash;
      server 10.233.34.80:3000;
      server 10.233.34.81:3000;
    }
	
    upstream eipo-service {
        ip_hash;
        server 10.233.34.80:8190;
        server 10.233.34.81:8190;
    }


# Settings for a TLS enabled server.

    server {
        listen       8443 ssl http2;
        listen       [::]:8443 ssl http2;
        server_name  cis-uat.reason.com.hk;
        #root         /usr/share/nginx/html;

	ssl_certificate "/etc/nginx/cert/wildcard_reason_com_hk.crt";
        ssl_certificate_key "/etc/nginx/cert/wildcard_reason_com_hk.key";
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout  10m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;
	ssl_protocols TLSv1.2 TLSv1.3;
        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

	root /usr/share/nginx/html;

        location ~ ^.*/index.html$ {
                add_header Cache-Control "no-cache, no-store, must-revalidate";
        }

        if ( $request_method = 'OPTIONS' ) { 
            return 200;
        }
          
        location @redirect {
                return 301 /cisi/;
        }

        location /cisi/ {
             root /usr/share/nginx/html;
        }
     
        location /notification-service/ {
            include /etc/nginx/conf.d.custom/cors.conf;
            proxy_pass         http://notification-service/;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }
          
        location /auth-service/ {
            include /etc/nginx/conf.d.custom/cors.conf;
            proxy_pass         http://auth-service/;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }

	location /cis/rs/trading/v1/queryTwoFaEnrollment {
                proxy_pass         http://notification-service/2fa-enrollment;
		allow 0.0.0.0;
                allow 172.19.33.17;
                allow 172.19.33.18;
                allow 172.19.33.19;
                allow 172.19.33.20;
                deny all;
        }

        location /cis/rs/ {
            include /etc/nginx/conf.d.custom/cors.conf;
            proxy_pass         http://cis-tomcat;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
	        client_max_body_size 50m;
        }

        location /edda-webhook/ {
            proxy_pass http://edda-webhook/;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
        }

        location /fundio-service/ {
            proxy_pass         http://fundio-service/;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            client_max_body_size 50m;
	    }
		
		location /fundtrading-service/ {
                proxy_pass         http://fundtrading-service/;
                proxy_set_header   Host             $host;
                proxy_set_header   X-Real-IP        $remote_addr;
                proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
                client_max_body_size 50m;
        }
		
		location /eipo-service/ {
            proxy_pass         http://eipo-service/;
            proxy_set_header   Host             $host;
            proxy_set_header   X-Real-IP        $remote_addr;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
			include /etc/nginx/includes/prod_cors.conf;
        }

        error_page 404 = @redirect;

        error_page 500 502 503 504 /50x.html;
            location = /50x.html {
        }
    }
}