feat: centralize nginx TLS and proxy defaults

conf.d/00-request-maps.conf.template

@@ -0,0 +1,46 @@
+map_hash_bucket_size 128;
+
+# Normalize the Connection header for WebSocket upgrades.
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+geo $is_internal {
+    default         0;
+    172.30.0.1      1;
+    192.168.10.0/24 1;
+}
+
+map $http_x_origin_token $gateway_provider {
+    default            '';
+    ${EO_ORIGIN_TOKEN} edgeone;
+}
+
+map $gateway_provider $gateway_client_ip {
+    default '';
+    edgeone $http_eo_connecting_ip;
+}
+
+map $gateway_client_ip $valid_gateway_client_ip {
+    default           0;
+    ~^[0-9A-Fa-f:.]+$ 1;
+}
+
+map $is_internal:$gateway_provider:$valid_gateway_client_ip $access_source {
+    default     denied;
+    ~^1:        internal;
+    0:edgeone:1 edgeone;
+}
+
+map $access_source $allow_access {
+    default  0;
+    internal 1;
+    edgeone  1;
+}
+
+map $access_source $trusted_client_ip {
+    default  $remote_addr;
+    internal $remote_addr;
+    edgeone  $gateway_client_ip;
+}