# {{ ansible_managed }}

proxy_cache_path /var/lib/nginx/cache levels=1:2 keys_zone=cdncache:20m max_size=1g inactive=48h;

{% for domain in cdn_domains %}
server {
    listen 8800 ssl proxy_protocol;
    http2 on;

    server_name {{ domain }};

    ssl_certificate /etc/letsencrypt/live/{{ domain }}/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/{{ domain }}/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/{{ domain }}/chain.pem;

    include includes/ssl.conf;

    real_ip_header proxy_protocol;

    set_real_ip_from 127.0.0.1;

    proxy_cache_use_stale error timeout http_500 http_502 http_503 http_504;

    location / {
        proxy_cache cdncache;
        add_header X-Cache-Status $upstream_cache_status;
        proxy_pass https://{{ wireguard.clients.ingress.ip }}:443;
    }
}
{% endfor %}