# Allow requests only from the internal network or a trusted gateway.
if ($allow_access = 0) {
    return 403;
}

# Forward normalized client metadata.
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $trusted_client_ip;
proxy_set_header X-Forwarded-For   $trusted_client_ip;
proxy_set_header X-Forwarded-Proto $scheme;

# Do not expose gateway authentication metadata to upstream services.
proxy_set_header X-Origin-Token   '';
proxy_set_header EO-Connecting-IP '';

# Support WebSocket upgrades.
proxy_http_version 1.1;
proxy_set_header Upgrade    $http_upgrade;
proxy_set_header Connection $connection_upgrade;