events { worker_connections 1024; }
http {
    server_tokens off;
    # Do not retain query strings or credentials in access logs.
    log_format norden '$remote_addr $request_method $uri $status';
    access_log /dev/stdout norden;
    error_log /dev/stderr warn;
    client_max_body_size 2m;
    client_header_timeout 15s;
    client_body_timeout 30s;
    send_timeout 60s;
    server {
        listen 8080;
        server_name _;
        # This rehearsal exposes public content only. Admin requires TLS and
        # an explicit access policy before it is enabled on a real server.
        location = /admin { return 403; }
        location ^~ /admin/ { return 403; }
        location = /api/admin { return 403; }
        location ^~ /api/admin/ { return 403; }
        location = /api/health { return 404; }
        location / {
            proxy_pass http://web:3000;
            proxy_http_version 1.1;
            proxy_set_header Host $http_host;
            proxy_set_header X-Forwarded-Host $http_host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-For $remote_addr;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_buffering off;
            proxy_read_timeout 60s;
        }
    }
}