nginx.tmpl

{{ define "upstream" }}
	{{ if .Address }}
		{{/* If we got the containers from swarm and this container's port is published to host, use host IP:PORT */}}
		{{ if and .Container.Node.ID .Address.HostPort }}
			# {{ .Container.Node.Name }}/{{ .Container.Name }}
			server {{ .Container.Node.Address.IP }}:{{ .Address.HostPort }};
		{{/* If there is no swarm node or the port is not published on host, use container's IP:PORT */}}
		{{ else }}
			# {{ .Container.Name }}
			server {{ .Address.IP }}:{{ .Address.Port }};
		{{ end }}
	{{ else }}
		# {{ .Container.Name }}
		server {{ .Container.IP }} down;
	{{ end }}
{{ end }}

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}

# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}

gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;

log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';

access_log /proc/self/fd/1 vhost;
error_log /proc/self/fd/2;

# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;

proxy_connect_timeout 5;
proxy_read_timeout 600;
proxy_send_timeout 600;

{{ range $service, $containers := groupByMulti $ "Env.LOCATION" "," }}

upstream {{ $service }} {
{{ range $container := $containers }}
	{{ $addrLen := len $container.Addresses }}
	{{/* If only 1 port exposed, use that */}}
	{{ if eq $addrLen 1 }}
		{{ $address := index $container.Addresses 0 }}
		{{ template "upstream" (dict "Container" $container "Address" $address) }}
	{{/* If more than one port exposed, use the one matching VIRTUAL_PORT env var, falling back to standard web port 80 */}}
	{{ else }}
		{{ $port := coalesce $container.Env.VIRTUAL_PORT "80" }}
		{{ $address := where $container.Addresses "Port" $port | first }}
		{{ template "upstream" (dict "Container" $container "Address" $address) }}
	{{ end }}
{{ end }}
}

{{/* Get the VIRTUAL_PROTO defined by containers w/ the same vhost, falling back to "http" */}}
{{ $proto := or (first (groupByKeys $containers "Env.VIRTUAL_PROTO")) "http" }}

{{/* Get the first cert name defined by containers w/ the same vhost */}}
{{ $certName := (first (groupByKeys $containers "Env.CERT_NAME")) }}

{{/* Get the best matching cert  by name for the vhost. */}}
{{ $vhostCert := (closest (dir "/etc/nginx/certs") (printf "%s.crt" $service))}}

{{/* vhostCert is actually a filename so remove any suffixes since they are added later */}}
{{ $vhostCert := replace $vhostCert ".crt" "" -1 }}
{{ $vhostCert := replace $vhostCert ".key" "" -1 }}

{{/* Use the cert specifid on the container or fallback to the best vhost match */}}
{{ $cert := (coalesce $certName $vhostCert) }}

{{ end }}

server {
  client_max_body_size 10G;

	listen 80;
{{ range $service, $containers := groupByMulti $ "Env.LOCATION" "," }}
  location /{{ $service }}/ {
    proxy_pass http://{{ $service }}/;
    proxy_redirect http://{{ $service }}/{{ $service }}/ http://$host/{{ $service }}/;
    proxy_set_header SCRIPT_NAME /{{ $service }};
  }
{{ end }}
}