server {
    listen 80;
    listen [::]:80;
    server_name dns-int.{{ http_domain_external }} dns-int.{{ http_domain_internal }};
    return 301 https://$http_host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name dns-int.{{ http_domain_external }} dns-int.{{ http_domain_internal }};
    index index.html index.htm;

    ssl_certificate /etc/nginx/ssl/{{ inventory_hostname_short }}.{{ http_domain_external }}/fullchain.pem;
    ssl_certificate_key /etc/nginx/ssl/{{ inventory_hostname_short }}.{{ http_domain_external }}/privkey.pem;
    ssl_prefer_server_ciphers       on;

    client_max_body_size            10m;
    client_body_buffer_size         128k;
    proxy_redirect                  off;
    proxy_connect_timeout           90;
    proxy_send_timeout              90;
    proxy_read_timeout              90;
    proxy_buffers                   32 4k;
    proxy_buffer_size               8k;
    proxy_set_header                Host $http_host;
    proxy_set_header                X-Scheme $scheme;
    proxy_set_header                X-Real-IP $remote_addr;
    proxy_set_header                X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_headers_hash_bucket_size  64;

    location ~ ^/static/  {
        include     mime.types;
        root        {{ pdns_admin_path }}/app;
        location    ~* \.(jpg|jpeg|png|gif)$ { expires 365d; }
        location    ~* ^.+.(css|js)$ { expires 7d; }
    }

    location ~ ^/upload/  {
        include     mime.types;
        root        {{ pdns_admin_path }};
        location    ~* \.(jpg|jpeg|png|gif)$ { expires 365d; }
        location    ~* ^.+.(css|js)$ { expires 7d; }
    }

    location / {
        proxy_pass              http://unix:{{ pdns_admin_path }}/powerdns-admin.sock;
        proxy_read_timeout      120;
        proxy_connect_timeout   120;
        proxy_redirect          http:// $scheme://;
   }
}