default.conf

server {
    listen 443 ssl;
    server_name  $NGINX_HOST;
    ssl_protocols TLSv1.3;
    ssl_certificate /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    # max upload size
    client_max_body_size 10m;

    # very long url for delega ticket
    large_client_header_buffers 4 16k;

    # deny iFrame
    add_header X-Frame-Options "DENY";

    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;

    root /usr/share/nginx/html;
    try_files $uri/index.html $uri @satosa;

    location @satosa {
      rewrite /.well-known/jar-issuer/OpenID4VP /OpenID4VP/.well-known/jar-issuer break;
      rewrite /.well-known/jwt-vc-issuer/OpenID4VP /OpenID4VP/.well-known/jwt-vc-issuer break;
      include /etc/nginx/uwsgi_params;
      
      uwsgi_pass iam-proxy-italia:10000;
      uwsgi_param Host $host;
      uwsgi_param X-Real-IP $remote_addr;
      uwsgi_param X-Forwarded-For $proxy_add_x_forwarded_for;
      uwsgi_param X-Forwarded-Proto $http_x_forwarded_proto;
      uwsgi_param HTTP_X_FORWARDED_PROTOCOL https;

      uwsgi_connect_timeout 75s;
      uwsgi_read_timeout 40;
      uwsgi_buffer_size          128k;
      uwsgi_buffers              4 256k;
      uwsgi_busy_buffers_size    256k;
      uwsgi_param SERVER_ADDR $server_addr;
    }

    include ./conf.d/sites-enabled/*.conf;

    error_page 404 /404.html;
    location = /404.html {
        root   /usr/share/nginx/html/errors;
    }

    error_page 403 /403.html;
    location = /403.html {
        root   /usr/share/nginx/html/errors;
    }

    # redirect server error pages to the static page /50x.html
    error_page 500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html/errors;
    }
}