server {
  listen            443 ssl default_server;
#  listen            443 ssl http2 default_server;
  server_name  aws1.api.vic.net;

#RESTRICTIONS
  large_client_header_buffers 32 2k;
  client_max_body_size 8M;
  client_body_buffer_size 8M;
  proxy_buffering off;
  proxy_max_temp_file_size 0;
  etag off;

#  underscores_in_headers          on;
#  ignore_invalid_headers          off;
  #ssl_protocols TLSv1.3;
  ssl_protocols TLSv1.2 TLSv1.3;

#SSL Configuration
  ssl_certificate "/etc/nginx/Ta6X_Server_9000.crt";
  ssl_certificate_key "/etc/nginx/Ta6X_Server_9000.key";


#Client Certificates
      ssl_client_certificate "/etc/nginx/ca.crt";
      ssl_verify_client on;

#Default nginx parameters.
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout  60m;
        ssl_ciphers HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers on;

  proxy_read_timeout          75s;
  # proxy_set_header            Host $http_host;
  # proxy_set_header            X-Real-IP $remote_addr;
  # proxy_set_header            X-Forwarded-Host $host;
  # proxy_set_header            X-Forwarded-Server $host;
  # proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_buffer_size           128k;
  proxy_buffers               4 256k;
  proxy_busy_buffers_size     256k;
  proxy_http_version 1.1;
  proxy_set_header Connection "";

  #Echo header

  add_header comm-context $http_comm_context;


  location / {

   proxy_http_version 1.1;
   proxy_set_header Connection "";
   keepalive_timeout 28800s;
   keepalive_requests 300000;
   include                 naxsi.rules;
   limit_req zone=limitreq burst=350 nodelay;
   proxy_read_timeout      75s;
   proxy_set_header        asp-ip $remote_addr;
   proxy_pass              http://haproxy;
   add_header              cl_conn_ctx $http_cl_conn_ctx always;
   proxy_set_header TC_VERIFY "";
   proxy_redirect off;
  }

   location ~ (A|B) {

   proxy_http_version 1.1;
   proxy_set_header Connection "";
   keepalive_timeout 28800s;
   keepalive_requests 300000;
   include                 naxsi.rules;
   limit_req zone=limitreq burst=350 nodelay;
   proxy_read_timeout      75s;
   proxy_set_header        asp-ip $remote_addr;
   proxy_pass              http://haproxy;
   add_header              cl_conn_ctx $http_cl_conn_ctx always;
   access_log              /var/log/nginx/custom_access.log main buffer=10k flush=1s;
   access_log              /var/log/nginx/custom_access_abnormal.log errors  buffer=10k flush=1s if=$abnormal;
   error_log               /var/log/nginx/custom_error.log        warn;
   proxy_redirect off;
  }

  
   include                 /etc/nginx/errors.conf;
}
