server {
    # ${REVERSE_PROXY_SERVER_NAME}
    listen                             ${FRONT_PROXY_PORT};
    server_name                        ${REVERSE_PROXY_SERVER_NAME};

    # security headers
    add_header X-Frame-Options         "SAMEORIGIN" always;
    add_header X-XSS-Protection        "1; mode=block" always;
    add_header X-Content-Type-Options  "nosniff" always;
    add_header Referrer-Policy         "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    # logging
    access_log /var/log/nginx/${REVERSE_PROXY_SERVER_NAME}.access.log;
    error_log  /var/log/nginx/${REVERSE_PROXY_SERVER_NAME}.error.log warn;

    # reverse proxy
    location / {
        proxy_pass                         http://${REVERSE_PROXY_IP}:${REVERSE_PROXY_PORT};
        proxy_cache_bypass                 $http_upgrade;

        # Proxy headers
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        "upgrade";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Port  $server_port;

        # Proxy timeouts
        proxy_connect_timeout              60s;
        proxy_send_timeout                 60s;
        proxy_read_timeout                 60s;
    }  
}