proxy_cache_path /var/cache/nginx/mirror levels=1:2 keys_zone=mirror_cache:100m max_size=10g inactive=12h use_temp_path=off;

map $request_uri $mirror_cache_key {
    default $scheme$request_method$host$request_uri;
}

upstream concelier_backend {
    server concelier:8445;
    keepalive 32;
}

upstream excititor_backend {
    server excititor:8448;
    keepalive 32;
}

server {
    listen 80;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name mirror-primary.stella-ops.org;

    ssl_certificate     /etc/nginx/tls/mirror-primary.crt;
    ssl_certificate_key /etc/nginx/tls/mirror-primary.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    auth_basic "StellaOps Mirror – primary";
    auth_basic_user_file /etc/nginx/secrets/mirror-primary.htpasswd;

    include /etc/nginx/conf.d/mirror-locations.conf;
}

server {
    listen 443 ssl http2;
    server_name mirror-community.stella-ops.org;

    ssl_certificate     /etc/nginx/tls/mirror-community.crt;
    ssl_certificate_key /etc/nginx/tls/mirror-community.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    auth_basic "StellaOps Mirror – community";
    auth_basic_user_file /etc/nginx/secrets/mirror-community.htpasswd;

    include /etc/nginx/conf.d/mirror-locations.conf;
}