template.conf

{# Let folks know this wasn't a manual configuration #}
# This configuration file was generated with mechanic.

{% macro httpsSettings(settings, site) %}
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_certificate {{ settings.conf }}/../certs/{{ site.shortname }}.cer;
  ssl_certificate_key {{ settings.conf }}/../certs/{{ site.shortname }}.key;
  ssl_prefer_server_ciphers on;
{% endmacro %}

{% macro server(site, settings, options) %}

  include "{{ settings.overrides }}/{{ site.shortname }}/top";

  server {

    gzip on;
    gzip_types text/css text/javascript image/svg+xml
      application/vnd.ms-fontobject application/x-font-ttf
      application/x-javascript application/javascript;

    listen {{ settings.bind }}:{{ options.port }}{% if options.https %} ssl {% if settings.http2 %}http2{% endif %}{% endif %}{% if site.default and not site.canonical %} default_server{% endif %};

    server_name {{ site.host }}{% if site.aliases and (not site.canonical) %} {{ site.aliases | join(" ") }}{% endif %};

    {% if options.https %}
      {{ httpsSettings(settings, site) }}
    {% endif %}

    client_max_body_size 32M;

    access_log {{ settings.logs }}/{{ site.shortname }}.access.log;
    error_log {{ settings.logs }}/{{ site.shortname }}.error.log;

    {% if site.https and site['redirect-to-https'] and not options.https %}
      location / {
        rewrite ^(.*)$ https://{{ site.host }}$1{% if site.permanent %} permanent{% endif %};
      }
    {% elif site['redirect'] %}
      location / {
        rewrite ^(.*)$ {{ site['redirect'] }}{% if site.permanent %} permanent{% endif %};
      }
    {% elif site['redirect-full'] %}
      location / {
        rewrite ^(.*)$ {{ site['redirect-full'] }}$1{% if site.permanent %} permanent{% endif %};
      }
    {% else %}
      include "{{ settings.overrides }}/{{ site.shortname }}/server";

      {# We need a named location block in order to use try_files. #}

      {% set defaultBackendGroup = site.backendGroups[0] %}
      {% set proxyRoot = defaultBackendGroup and (defaultBackendGroup.path == '/') %}
      {% if proxyRoot %}
        location @proxy-{{ site.shortname }}-{{ options.port }} {
          {% if site['https-upstream'] %}
            proxy_pass https://upstream-{{ site.shortname }}-1;
            proxy_ssl_session_reuse on;
            proxy_ssl_protocols TLSv1.2 TLSv1.3;
          {% else %}
            proxy_pass http://upstream-{{ site.shortname }}-1;
          {% endif %}

          {% if site['websockets'] or site['websocket'] %}
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
          {% endif %}

          proxy_next_upstream error timeout invalid_header http_500 http_502
        http_503 http_504;
          proxy_redirect off;
          proxy_buffering off;
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;
          include "{{ settings.overrides }}/{{ site.shortname }}/proxy";
        }
      {% endif %}

      location / {
        {%- if site.static %}root {{ site.static }};{% endif %}
        {% if site.autoindex %}
          autoindex on;
          {% if proxyRoot %}
            try_files $uri $uri/ @proxy-{{ site.shortname }}-{{ options.port }};
          {% endif %}
        {% else %}
          {% if proxyRoot %}
            try_files $uri @proxy-{{ site.shortname }}-{{ options.port }};
          {% endif %}
        {% endif %}
        expires 7d;
        include "{{ settings.overrides }}/{{ site.shortname }}/location";
      }

      {% for backendGroup in site.backendGroups %}
        {% if backendGroup.path != '/' %}
          location {{ backendGroup.path }} {
            {% if site['https-upstream'] %}
              proxy_pass https://upstream-{{ site.shortname }}-{{ loop.index }};
              proxy_ssl_session_reuse on;
              proxy_ssl_protocols TLSv1.2 TLSv1.3;
            {% else %}
              proxy_pass http://upstream-{{ site.shortname }}-{{ loop.index }};
            {% endif %}
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
          }
        {% endif %}
      {% endfor %}
    {% endif %}
  }

  {% if site.default or (site.canonical and site.aliases) %}
    server {
      listen {{ settings.bind }}:{{ options.port }}{% if site.default and site.canonical %} default_server{% endif %}{% if options.https %} ssl {% if settings.http2 %}http2{% endif %}{% endif %};
      server_name _{{ site.shortname }}_{{ options.port }}{% if site.aliases %} {{ site.aliases | join(' ') }}{% endif %};
      # canonicalize
      {% if options.https %}
        {{ httpsSettings(settings, site) }}
      {% endif %}
      location / {
        rewrite ^(.*)$ {% if options.https or (site.https and site['redirect-to-https']) %}https:{% else %}http:{% endif %}//{{ site.host }}$1{% if site.permanent %} permanent{% endif %} ;
      }
    }
  {% endif %}
{% endmacro %}

{% macro renderSite(site, settings) %}
  {% for backendGroup in site.backendGroups %}
    upstream upstream-{{ site.shortname }}-{{ loop.index }} {
      {% for backend in backendGroup.backends -%}
        server {{ backend }};
      {%- endfor %}
    }
  {% endfor %}

  {{ server(site, settings, { port: 80 }) }}

  {% if (site.https) %}
    {{ server(site, settings, { port: 443, https: true }) }}
  {% endif %}
{% endmacro %}

{% for site in sites %}
  {{ renderSite(site, settings) }}
{% endfor %}