server {
    listen 80;
    server_tokens off;
    server_name *.os-bird.univ-nantes.fr;

    return 301 https://$http_host$request_uri;
}


server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_tokens off;
    server_name *.os-bird.univ-nantes.fr;

    ssl_certificate /etc/nginx/ssl/server.crt;
    ssl_certificate_key /etc/nginx/ssl/server.key;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";

    root /dev/null;
    
    location ~ /edugain/ {
        proxy_buffering     off;
        proxy_http_version  1.1;
        proxy_set_header    Host                $http_host;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header    Upgrade             $http_upgrade;
        proxy_set_header    Connection          $http_connection;
        proxy_cookie_path   / /;
        if ($host ~* 172-20-5(.*)-(.*).os-bird.univ-nantes.fr ){
            set $ipma $1;
            set $ipmb $2;
            proxy_pass          http://172.20.5${ipma}.${ipmb}:5000;
        }
    }

    location ~ / {
        try_files $uri @https;
    }

    location @http {
        proxy_buffering     off;
        proxy_http_version  1.1;
        proxy_set_header    Host                $http_host;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header    Upgrade             $http_upgrade;
        proxy_set_header    Connection          $http_connection;
        proxy_cookie_path   / /;
        if ($host ~* 172-20-5(.*)-(.*).os-bird.univ-nantes.fr ){
            set $ipma $1;
            set $ipmb $2;
            proxy_pass         http://172.20.5${ipma}.${ipmb};
        }
    }

    location @https {
        proxy_buffering     off;
        proxy_http_version  1.1;
        proxy_set_header    Host                $http_host;
        proxy_set_header    X-Real-IP           $remote_addr;
        proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
        proxy_set_header    Upgrade             $http_upgrade;
        proxy_set_header    Connection          $http_connection;
        proxy_cookie_path   / /;
        proxy_intercept_errors on;
        recursive_error_pages on;
        if ($host ~* 172-20-5(.*)-(.*).os-bird.univ-nantes.fr ){
            set $ipma $1;
            set $ipmb $2;
            proxy_pass         https://172.20.5${ipma}.${ipmb};
        }
        error_page 502 = @http;
    }

    access_log  /var/log/nginx/access.log;
    error_log   /var/log/nginx/error.log;
}