load_module /usr/lib64/nginx/modules/ngx_stream_module.so;

worker_processes 8;

events {}

stream {
    log_format basic '$remote_addr $name [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time';

    include /etc/nginx/stream.d/*.conf;

    # Map all SSL parsed server names to hosts
    map $ssl_preread_server_name $name {

        "" 127.0.0.1:443;

        # For each domain we need to stream to a remote server, forward to internal domain
        {% for domain in stream_ssl %}
        {{ domain.external_domain }} {{ domain.internal_domain }}:{{ domain.internal_port }};
        {% endfor %}

        # For each domain we want to terminate, forward to internal http server
        {% for domain in terminate_ssl %}
        {{ domain.external_domain }} 127.0.0.1:443;
        {% endfor %}

        default {{ nginx.defaults.domain }}:443;
    }

    # Forward 80 traffic
    server {
        access_log /var/log/nginx/stream-access-80.log basic;
        listen {{ ansible_default_ipv4.address }}:80;
        resolver 1.1.1.1;
        proxy_pass $name;
        ssl_preread on;
        proxy_socket_keepalive on;
    }

    # Forward 443 traffic
    server {
        access_log /var/log/nginx/stream-access-443.log basic;
        listen {{ ansible_default_ipv4.address }}:443;
        resolver 1.1.1.1;
        proxy_pass $name;
        ssl_preread on;
        proxy_socket_keepalive on;
    }

}

http {
    log_format compression '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status $bytes_sent '
                       '"$http_referer" "$http_user_agent" "$gzip_ratio"';

    include /etc/nginx/http.d/*.conf;

    server {
        access_log /var/log/nginx/http-access.log compression;
        listen 127.0.0.1:80 default_server;
        return 301 https://$host$request_uri;
    }
}