# valet stub: secure.proxy.valet.conf

server {
    listen 127.0.0.1:80;
    #listen VALET_LOOPBACK:80; # valet loopback
    server_name VALET_SITE www.VALET_SITE *.VALET_SITE;
    return 301 https://$host$request_uri;
}

server {
    listen 127.0.0.1:443 ssl http2;
    #listen VALET_LOOPBACK:443 ssl http2; # valet loopback
    server_name VALET_SITE www.VALET_SITE *.VALET_SITE;
    root /;
    charset utf-8;
    client_max_body_size 128M;
    http2_push_preload on;

    location /VALET_STATIC_PREFIX/ {
        internal;
        alias /;
        try_files $uri $uri/;
    }

    ssl_certificate "VALET_CERT";
    ssl_certificate_key "VALET_KEY";

    access_log off;
    error_log "VALET_HOME_PATH/Log/VALET_SITE-error.log";

    error_page 404 "VALET_SERVER_PATH";

    location / {
        proxy_pass VALET_PROXY_HOST;
        proxy_set_header   Host              $host;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_set_header   X-Client-Verify   SUCCESS;
        proxy_set_header   X-Client-DN       $ssl_client_s_dn;
        proxy_set_header   X-SSL-Subject     $ssl_client_s_dn;
        proxy_set_header   X-SSL-Issuer      $ssl_client_i_dn;
        proxy_set_header   X-NginX-Proxy true;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
        proxy_http_version 1.1;
        proxy_read_timeout 1800;
        proxy_connect_timeout 1800;
        chunked_transfer_encoding on;
        proxy_redirect off;
        proxy_buffering off;
    }

    location ~ /\.ht {
        deny all;
    }
}