nginx.conf

proxy_set_header HOST $http_host;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

server {
	listen 80 default_server;
	server_name _;
	return 301 https://$host$request_uri;
}

server {
	server_name api.gavelci.us;
	listen 443 ssl;
	ssl_certificate    /data/secrets/api.crt;
	ssl_certificate_key    /data/secrets/api.key;

	gzip             on;
	gzip_comp_level  7;
	gzip_types       application/json;

	location / {
		# We need to turn an API token only known in the gavel-ci DB
		# into a JWT signed bearer the jobserv API can validate.
		auth_request     /internal-token-auth;
		auth_request_set $auth $upstream_http_authorization;
		proxy_set_header Authorization $auth;
		proxy_set_header Host $host;
		proxy_set_header X-Forwarded-Proto $scheme;

		proxy_pass http://api:8000/;
	}

	location = /internal-token-auth {
		internal;
		proxy_pass              http://ui:8000/settings/token/auth/;
		proxy_pass_request_body off;
		proxy_set_header        Content-Length "";
		proxy_set_header        X-Original-URI $request_uri;
	}
}

server {
	server_name gavelci.us;
	listen 443 ssl;
	ssl_certificate    /data/secrets/ui.crt;
	ssl_certificate_key    /data/secrets/ui.key;

	location / {
		proxy_pass http://ui:8000/;
	}
}