20 lines
642 B
Plaintext
20 lines
642 B
Plaintext
# Allow requests only from the internal network or a trusted gateway.
|
|
if ($allow_access = 0) {
|
|
return 403;
|
|
}
|
|
|
|
# Forward normalized client metadata.
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $trusted_client_ip;
|
|
proxy_set_header X-Forwarded-For $trusted_client_ip;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
|
|
# Do not expose gateway authentication metadata to upstream services.
|
|
proxy_set_header X-Origin-Token '';
|
|
proxy_set_header EO-Connecting-IP '';
|
|
|
|
# Support WebSocket upgrades.
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection $connection_upgrade;
|