# TODO 
# - Move SSL termination here and remove from headscale.schleppe

map $http_upgrade $connection_upgrade {
  default      keep-alive;
  'websocket'  upgrade;
  ''           close;
}

server {
  listen 443 ssl http2;
  listen [::]:443 ssl http2;

  server_name flow.schleppe.cloud;

  location / {
    resolver 10.0.0.72;
    proxy_pass  http://headscale.schleppe:8080;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $server_name;
    proxy_redirect http:// https://;
    proxy_buffering off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
    more_set_headers 'Strict-Transport-Security: max-age=15552000; includeSubDomains';
  }
}