fxa-selfhosting/examples/reverse_proxy_unixsocket/reverse_proxy.conf

### reverse proxy must work before docker-compose up
### cert must valid
server  {
	listen  443 ssl;
	server_name *.fxa.example.local; # if use seperate cert you may have seprate server block

	ssl_certificate <somepath>/wild.fxa.example.local.cer ;
	ssl_certificate_key <somepath>/wild.fxa.example.local.key; 

	# NOTE: Nginx need to have +x access on all directories leading to the socket file.
	# SEE: https://stackoverflow.com/questions/25774999/nginx-stat-failed-13-permission-denied
	# NOTE: Sometimes you need to check your SELinux Status.
	# NOTE: for nginx running under systemd and PrivateTmp is enabled in service file, do not use /tmp folder.
	location / {
		proxy_pass http://unix:/var/run/fxa-selfhosting/nginx.sock:;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	}
	## for channel server (using websocket)
	location = /v1/ws/ {
		proxy_pass http://unix:/var/run/fxa-selfhosting/nginx.sock:;
		proxy_set_header Host $host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection $connection_upgrade;
	}

}

map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}