---

server {
  listen 80;
  server_name gl.susanin.ai;

    location /.well-known/acme-challenge/ { alias /opt/letsencrypt/dir/; }

    location / {
    return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name gl.susanin.ai;

    allow 185.155.19.19/32;
    allow 54.38.93.155/32;
    allow 194.33.48.221/32;
    allow 172.17.0.0/16;
#    deny all;

    ssl_certificate      /etc/letsencrypt/live/susanin.ai/fullchain.pem;
    ssl_certificate_key  /etc/letsencrypt/live/susanin.ai/privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
#    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_ciphers  "HIGH:!RC4:!aNULL:!MD5:!kEDH";
    add_header Strict-Transport-Security 'max-age=604800';
    client_max_body_size 500M;
    sendfile on;
    send_timeout 900s;


		location / {
			proxy_pass https://127.0.0.1:445;
			proxy_redirect https://127.0.0.1:445/ /;
			proxy_set_header Host $host;
			proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
			proxy_set_header X-Forwarded-Proto $scheme;
			proxy_set_header X-Real-IP $remote_addr;
		}

location /-/cable {
    proxy_pass https://127.0.0.1:445;
    proxy_redirect https://127.0.0.1:445/ /;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 36000s;
}

location /-/kubernetes-agent/ {
    proxy_pass https://127.0.0.1:445;
    proxy_redirect https://127.0.0.1:445/ /;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 36000s;
}

	}