feat: centralize nginx TLS and proxy defaults

snippets/proxy.conf.template

@@ -1,19 +1,19 @@
-# restrict access
+# Allow requests only from the internal network or a trusted gateway.
 if ($allow_access = 0) {
     return 403;
 }
 
-# set headers
+# Forward normalized client metadata.
 proxy_set_header Host              $host;
 proxy_set_header X-Real-IP         $trusted_client_ip;
 proxy_set_header X-Forwarded-For   $trusted_client_ip;
 proxy_set_header X-Forwarded-Proto $scheme;
 
-# clean headers
-proxy_set_header X-Origin-Token    '';
-proxy_set_header EO-Connecting-IP  '';
+# Do not expose gateway authentication metadata to upstream services.
+proxy_set_header X-Origin-Token   '';
+proxy_set_header EO-Connecting-IP '';
 
-# enable websockets: http://nginx.org/en/docs/http/websocket.html
+# Support WebSocket upgrades.
 proxy_http_version 1.1;
-proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Upgrade    $http_upgrade;
 proxy_set_header Connection $connection_upgrade;