# Only the configured immediate TLS proxy may assert the original scheme.
# The Docker entrypoint substitutes TRUSTED_TLS_PROXY_CIDR, not Nginx variables.
geo $pcm_trusted_tls_proxy {
  default 0;
  ${TRUSTED_TLS_PROXY_CIDR} 1;
}
map "$pcm_trusted_tls_proxy:$http_x_forwarded_proto" $pcm_forwarded_proto {
  default $scheme;
  "1:https" https;
  "1:http" http;
}
server {
  listen 80;
  server_name _;
  client_max_body_size 250m;
  client_body_buffer_size 250m;
  root /usr/share/nginx/html;
  location /api/ {
    proxy_pass http://api:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $pcm_forwarded_proto;
    proxy_set_header Forwarded "";
    proxy_set_header X-Forwarded-Ssl "";
    proxy_set_header X-Forwarded-Scheme "";
  }
  location /admin/pghero {
    proxy_pass http://api:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $pcm_forwarded_proto;
    proxy_set_header Forwarded "";
    proxy_set_header X-Forwarded-Ssl "";
    proxy_set_header X-Forwarded-Scheme "";
  }
  location / { try_files $uri $uri/ /index.html; }
}