load_module /usr/lib64/nginx/modules/ngx_stream_module.so;

worker_processes 8;

events {}

stream {
    log_format basic '$remote_addr $domain [$time_local] '
                 '$protocol $status $bytes_sent $bytes_received '
                 '$session_time';

    include /etc/nginx/stream.d/*.conf;

    # Map all SSL parsed server names to hosts
    map $ssl_preread_server_name $domain {

        "" 127.0.0.1:443;

        # For each domain we need to stream to a remote server, forward to internal domain
        {% for domain in stream_ssl %}
        {{ domain.external.domain }} {{ domain.internal.domain }}:{{ domain.internal.port }};
        {% endfor %}

        # For each domain we want to terminate, forward to internal http server
        {% for domain in reeseapps %}
        {{ domain.external.domain }} 127.0.0.1:443;
        {% endfor %}

        {% for domain in reeseseal %}
        {{ domain.external.domain }} 127.0.0.1:443;
        {% endfor %}

        default {{ nginx.defaults.domain }}:443;
    }

    # Forward 443 traffic
    server {
        access_log /var/log/nginx/stream-access-443.log basic;
        listen {{ ansible_default_ipv4.address }}:443;
        resolver 1.1.1.1;
        proxy_pass $domain;
        ssl_preread on;
        proxy_socket_keepalive on;
    }
}

http {
    log_format compression '$remote_addr - $remote_user [$time_local] '
                       '"$request" $status $bytes_sent '
                       '"$http_referer" "$http_user_agent" "$gzip_ratio"';

    server {
        access_log /var/log/nginx/http-access.log compression;

        listen 80 default_server;

        if ($scheme = "http") {
            return 301 https://$host:443$request_uri;
        }
    }

    include /etc/nginx/http.d/*.conf;
}