k8scd/ansible/mailserver/roles/nginx/templates/nginx.conf.j2

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
}

http {
    sendfile on;
    tcp_nopush on;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    gzip on;

    include /etc/nginx/sites-enabled/*;
}

stream {
    log_format stream '$remote_addr [$time_local] '
                      '$protocol $status $bytes_sent $bytes_received '
                      '$session_time "$ssl_preread_server_name"';
    access_log /var/log/nginx/stream.log stream;

    map $ssl_preread_server_name $tls_backend {
{% for domain in nginx_local_tls_domains %}
        {{ domain }}  local_tls;
{% endfor %}
        default       k8s_tls;
    }

    upstream local_tls {
        server 127.0.0.1:8443;
    }

    include /etc/nginx/stream.d/*.conf;

    server {
        listen 443;
        listen [::]:443;
        ssl_preread on;
        proxy_pass $tls_backend;
    }
}