# =========================================================================
# UPSTREAMS - СТАРЫЙ СЕРВЕР (Группа 5)
# =========================================================================
upstream keycloak_5 { 
    server oldelph:8282; 
}

upstream elph_api_5 {
    least_conn;
    server apiserver:3090 weight=1 max_fails=3 fail_timeout=30s;
    server apiserver:3091 weight=1 max_fails=3 fail_timeout=30s;
    server apiserver:3092 weight=1 max_fails=3 fail_timeout=30s;
}

upstream elph_chat_server_5 {
    hash $cookie_rc_token consistent;
    server oldelph:3011;
    server oldelph:3012;
}

upstream elph_chat_client_5 {
    server oldelph:8080;
}

upstream call_history_service_5 {
    server oldelph:3000;
}

upstream status_service_5 {
    server oldelph:3002;
}

upstream file_service_5 {
    server oldelph:3005;
}

upstream address_book_5 {
    server oldelph:4000;
}

upstream push_gateway_5 {
    server oldelph:3003;
}

upstream elph_call_api_5 {
    server apiserver:8089;
}

upstream elph_web_5 {
    server oldelph:4433;
}

upstream aup_config_5 {
    server 127.0.0.1:1443;
}

upstream elph_work_schedule_5 {
    server 127.0.0.1:3006;
}

upstream mini_apps_5 {
    server oldelph:3007;
}

# =========================================================================
# UPSTREAMS - НОВЫЙ СЕРВЕР (Группа 88)
# =========================================================================
upstream keycloak_88 { 
    server newelph:8282; 
}

upstream elph_api_88 {
    least_conn;
    server newelph:3090 weight=1 max_fails=3 fail_timeout=30s;
    server newelph:3091 weight=1 max_fails=3 fail_timeout=30s;
    server newelph:3092 weight=1 max_fails=3 fail_timeout=30s;
}

upstream elph_chat_server_88 {
    hash $cookie_rc_token consistent;
    server newelph:3011;
    server newelph:3012;
}

upstream elph_chat_client_88 {
    server newelph:8080;
}

upstream call_history_service_88 {
    server newelph:3000;
}

upstream status_service_88 {
    server newelph:3002;
}

upstream file_service_88 {
    server newelph:3005;
}

upstream address_book_88 {
    server newelph:4000;
}

upstream push_gateway_88 {
    server newelph:3003;
}

upstream elph_call_api_88 {
    server newelph:8089;
}

upstream elph_web_88 {
    server newelph:4433;
}

upstream aup_config_88 {
    server 127.0.0.1:1443;
}

upstream elph_work_schedule_88 {
    server 127.0.0.1:3006;
}

upstream mini_apps_88 {
    server newelph:3007;
}

# =========================================================================
# ОБЩИЕ UPSTREAMS
# =========================================================================
upstream aup_keycloak { 
    server oldelph:443; 
}

# =========================================================================
# ОБЩИЕ НАСТРОЙКИ
# =========================================================================
limit_req_zone global_rps_count_zone zone=req_limit:10m rate=30r/s;

# =========================================================================
# БЛОК 1: ОБРАЩЕНИЕ ПО ДОМЕНУ -> НА НОВЫЙ СЕРВЕР (.88)
# =========================================================================
server {
    listen 443 ssl http2;
    server_name domain;

    access_log '/var/log/ecss/elph-proxy/access-log.log';
    error_log '/var/log/ecss/elph-proxy/error-log.log';
    
    client_max_body_size 200M;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_certificate /var/lib/ecss/elph-proxy/ssl/elph-proxy.crt;
    ssl_certificate_key /var/lib/ecss/elph-proxy/ssl/elph-proxy.key;

    resolver dns;

    add_header Access-Control-Allow-Headers "x-user-agent, x-client-version, Content-Type, Authorization";
    
    # Общие заголовки для всех проксируемых запросов
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    
    # Коррекция редиректов
    proxy_redirect https://oldelph/ /;
    proxy_redirect http://newelph:8282/ /elph/auth/;

    # =====================================================================
    # ОСНОВНОЕ API
    # =====================================================================
    location /elph_api/ {
        proxy_pass                    https://elph_api_88/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph_api/wss {
        proxy_pass https://elph_api_88;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph_api/api/ {
        proxy_pass https://elph_api_88/api/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location ~* ^/elph_api/downloadFile/(/?) {
        proxy_pass $arg_url;
        add_header Content-Disposition 'attachment; filename="$arg_name"';
        proxy_set_header Range "";
    }

    location ~* ^/elph_api/loadRemote/(/?) {
        proxy_pass $arg_url;
    }

    location ~* ^/elph_api/loadLocal/(.*\.(png|ico|gif|jpg|jpeg))$ {
        root /var/lib/ecss/elph-proxy/avatars/;
        autoindex off;
        expires 4h;
        try_files /$1 =404;
    }

    # =====================================================================
    # ЧАТ
    # =====================================================================
    location /elph_chat/file-upload/files/ {
        proxy_pass http://file_service_88/files/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_redirect off;
    }

    location /elph_chat/api {
        proxy_pass http://elph_chat_server_88/api;
        proxy_ssl_verify off;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
    }

    location /elph_chat/avatar {
        proxy_pass http://elph_chat_server_88/avatar;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
    }

    location /elph_chat/file-upload {
        proxy_pass http://elph_chat_server_88/file-upload;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
    }

    location /elph_chat/websocket {
        limit_req zone=req_limit burst=80;
        proxy_pass http://elph_chat_server_88/websocket;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /elph_chat/ {
        proxy_pass                    http://elph_chat_client_88/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
    }

    # =====================================================================
    # KEYCLOAK / AUTH
    # =====================================================================
    location /elph/auth/ {
        proxy_pass http://keycloak_88/;
        proxy_set_header X-Forwarded-Prefix /elph/auth;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }

    location /auth/ {
        proxy_pass https://aup_keycloak/auth/;
        proxy_ssl_verify off;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;
        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
        proxy_buffering off;
        proxy_buffer_size 32k;
        proxy_buffers 16 16k;
        proxy_max_temp_file_size 1024m;
        proxy_request_buffering on;
        add_header X-Upstream $upstream_addr;
    }

    location = /auth/openid-configuration {
        proxy_pass http://keycloak_88/realms/test/.well-known/openid-configuration;
    }

    location = /auth/me {
        default_type 'text/plain;charset=utf-8';

        if ($http_authorization = '') {
            set $empty '';
            add_header WWW-Authenticate 'error="unauthorized", error_description="Authentication required"' always;
            add_header Referrer-Policy 'no-referrer' always;
            add_header X-Content-Type-Options 'nosniff' always;
            return 401 $empty;
        }

        proxy_pass http://keycloak_88/realms/test/protocol/openid-connect/userinfo;
        proxy_set_header Authorization $http_authorization;
    }

    location = /auth/token-exchange {
        proxy_pass http://keycloak_88/realms/test/custom-token-exchange/issue-token;
    }

    # =====================================================================
    # WEB ИНТЕРФЕЙС
    # =====================================================================
    location ^~ /web/ {
        proxy_pass                    https://elph_web_88/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
    }

    # =====================================================================
    # ДОПОЛНИТЕЛЬНЫЕ СЕРВИСЫ
    # =====================================================================
    location /elph/call_history/ {
        proxy_pass                    http://call_history_service_88/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/status/ {
        proxy_pass                    http://status_service_88/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/store/ {
        proxy_pass                    http://file_service_88/;
        proxy_ssl_verify              off;
        proxy_http_version            1.1;
        proxy_request_buffering       off;
        proxy_buffering               off;
        proxy_buffer_size             2k;
        proxy_read_timeout            3600s;
        client_max_body_size 0;

        proxy_set_header Upgrade                  $http_upgrade;
        proxy_set_header Connection               "upgrade";
        proxy_set_header X-Forwarded-Host         $host;

        proxy_redirect  ~^(https?://[^/]+)(/tus/.*)$  $1/elph/store$2;
        proxy_redirect  ~^(/tus/.*)$                  /elph/store$1;
    }

    location /elph/push/websocket {
        proxy_pass                    https://push_gateway_88/socket.io/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
    }

    location /elph/push/ {
        return 403;
    }

    location /elph/address_book/ {
        rewrite ^/elph/address_book/(.*)$ /$1 break;
        proxy_pass http://address_book_88;
        proxy_http_version 1.1;
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/login {
        proxy_pass                    http://elph_chat_server_88/api/v1/login;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
    }

    location /elph/health {
        add_header Content-Type application/json;
        return 200 '{"proxy": {"enabled": true}}';
    }

    location /elph/call_api {
        proxy_pass                    https://elph_call_api_88/api/v1/sip;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/work-schedule/ {
        proxy_pass                    http://elph_work_schedule_88/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/mini_apps/ {
        proxy_pass                    http://mini_apps_88/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /callback {
        default_type application/json;
        return 200 '{"status": "success", "code": "$arg_code"}';
    }

    location = /aup/auth/token {
        proxy_pass https://aup_keycloak/auth/realms/ecss/protocol/openid-connect/token;
        proxy_ssl_verify off;
        proxy_ssl_server_name on;
    }

    # ROOT - AUP CONFIG
    location / {
        proxy_pass https://aup_config_88;
        proxy_ssl_verify off;
    }
}

# =========================================================================
# БЛОК 2: ОБРАЩЕНИЕ ПО IP -> НА СТАРЫЙ СЕРВЕР (.5)
# =========================================================================
server {
    listen 443 ssl default_server http2;
    server_name ipproxy;

    access_log '/var/log/ecss/elph-proxy/access-log.log';
    error_log '/var/log/ecss/elph-proxy/error-log.log';
    
    client_max_body_size 200M;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_certificate /var/lib/ecss/elph-proxy/ssl/elph-proxy.crt;
    ssl_certificate_key /var/lib/ecss/elph-proxy/ssl/elph-proxy.key;

    resolver dns;

    add_header Access-Control-Allow-Headers "x-user-agent, x-client-version, Content-Type, Authorization";
    
    # Общие заголовки для всех проксируемых запросов
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # =====================================================================
    # ОСНОВНОЕ API
    # =====================================================================
    location /elph_api/ {
        proxy_pass                    https://elph_api_5/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph_api/wss {
        proxy_pass https://elph_api_5;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph_api/api/ {
        proxy_pass https://elph_api_5/api/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location ~* ^/elph_api/downloadFile/(/?) {
        proxy_pass $arg_url;
        add_header Content-Disposition 'attachment; filename="$arg_name"';
        proxy_set_header Range "";
    }

    location ~* ^/elph_api/loadRemote/(/?) {
        proxy_pass $arg_url;
    }

    location ~* ^/elph_api/loadLocal/(.*\.(png|ico|gif|jpg|jpeg))$ {
        root /var/lib/ecss/elph-proxy/avatars/;
        autoindex off;
        expires 4h;
        try_files /$1 =404;
    }

    # =====================================================================
    # ЧАТ
    # =====================================================================
    location /elph_chat/file-upload/files/ {
        proxy_pass http://file_service_5/files/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_redirect off;
    }

    location /elph_chat/api {
        proxy_pass http://elph_chat_server_5/api;
        proxy_ssl_verify off;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
    }

    location /elph_chat/avatar {
        proxy_pass http://elph_chat_server_5/avatar;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
    }

    location /elph_chat/file-upload {
        proxy_pass http://elph_chat_server_5/file-upload;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
    }

    location /elph_chat/websocket {
        limit_req zone=req_limit burst=80;
        proxy_pass http://elph_chat_server_5/websocket;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
        proxy_connect_timeout 120s;
        proxy_send_timeout 120s;
        proxy_read_timeout 120s;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /elph_chat/ {
        proxy_pass                    http://elph_chat_client_5/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
    }

    # =====================================================================
    # KEYCLOAK / AUTH
    # =====================================================================
    location /elph/auth/ {
        proxy_pass http://keycloak_5/;
        proxy_set_header X-Forwarded-Prefix /elph/auth;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }

    location /auth/ {
        proxy_pass https://aup_keycloak/auth/;
        proxy_ssl_verify off;
        proxy_set_header Host $http_host;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        chunked_transfer_encoding off;
        proxy_connect_timeout 5s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;
        proxy_buffering off;
        proxy_buffer_size 32k;
        proxy_buffers 16 16k;
        proxy_max_temp_file_size 1024m;
        proxy_request_buffering on;
        add_header X-Upstream $upstream_addr;
    }

    location = /auth/openid-configuration {
        proxy_pass http://keycloak_5/realms/test/.well-known/openid-configuration;
    }

    location = /auth/me {
        default_type 'text/plain;charset=utf-8';

        if ($http_authorization = '') {
            set $empty '';
            add_header WWW-Authenticate 'error="unauthorized", error_description="Authentication required"' always;
            add_header Referrer-Policy 'no-referrer' always;
            add_header X-Content-Type-Options 'nosniff' always;
            return 401 $empty;
        }

        proxy_pass http://keycloak_5/realms/test/protocol/openid-connect/userinfo;
        proxy_set_header Authorization $http_authorization;
    }

    location = /auth/token-exchange {
        proxy_pass http://keycloak_5/realms/test/custom-token-exchange/issue-token;
    }

    # =====================================================================
    # WEB ИНТЕРФЕЙС
    # =====================================================================
    location ^~ /web/ {
        proxy_pass                    https://elph_web_5/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
    }

    # =====================================================================
    # ДОПОЛНИТЕЛЬНЫЕ СЕРВИСЫ
    # =====================================================================
    location /elph/call_history/ {
        proxy_pass                    http://call_history_service_5/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/status/ {
        proxy_pass                    http://status_service_5/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/store/ {
        proxy_pass                    http://file_service_5/;
        proxy_ssl_verify              off;
        proxy_http_version            1.1;
        proxy_request_buffering       off;
        proxy_buffering               off;
        proxy_buffer_size             2k;
        proxy_read_timeout            3600s;
        client_max_body_size 0;

        proxy_set_header Upgrade                  $http_upgrade;
        proxy_set_header Connection               "upgrade";
        proxy_set_header X-Forwarded-Host         $host;

        proxy_redirect  ~^(https?://[^/]+)(/tus/.*)$  $1/elph/store$2;
        proxy_redirect  ~^(/tus/.*)$                  /elph/store$1;
    }

    location /elph/push/websocket {
        proxy_pass                    https://push_gateway_5/socket.io/;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_read_timeout 60s;
        proxy_send_timeout 60s;
    }

    location /elph/push/ {
        return 403;
    }

    location /elph/address_book/ {
        rewrite ^/elph/address_book/(.*)$ /$1 break;
        proxy_pass http://address_book_5;
        proxy_http_version 1.1;
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/login {
        proxy_pass                    http://elph_chat_server_5/api/v1/login;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header X-Nginx-Proxy true;
        proxy_redirect off;
    }

    location /elph/health {
        add_header Content-Type application/json;
        return 200 '{"proxy": {"enabled": true}}';
    }

    location /elph/call_api {
        proxy_pass                    https://elph_call_api_5/api/v1/sip;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/work-schedule/ {
        proxy_pass                    http://elph_work_schedule_5/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /elph/mini_apps/ {
        proxy_pass                    http://mini_apps_5/;
        proxy_ssl_verify              off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 3600s;
        proxy_buffering off;
        proxy_buffer_size 2k;
    }

    location /callback {
        default_type application/json;
        return 200 '{"status": "success", "code": "$arg_code"}';
    }

    location = /aup/auth/token {
        proxy_pass https://aup_keycloak/auth/realms/ecss/protocol/openid-connect/token;
        proxy_ssl_verify off;
        proxy_ssl_server_name on;
    }

    # ROOT - AUP CONFIG
    location / {
        proxy_pass https://aup_config_5;
        proxy_ssl_verify off;
    }
}

# =========================================================================
# ПОРТ 80 - РЕДИРЕКТ НА HTTPS
# =========================================================================
server {
    listen 80;
    server_name domain ipproxy;
    
    location ~* ^/certificate/(.*\.(crt))$ {
        root /var/lib/ecss/elph-proxy/certificate;
        try_files /$1 =404;
    }
    
    location / {
        return 301 https://$host$request_uri;
    }
}
