pgadmin.conf

upstream pgadmin {
     server pgadmin:80;
}

log_format ssl_client '$remote_addr - $remote_user [$time_local] '
                      '$ssl_client_s_dn $ssl_client_verify '
                      '"$request" $status $body_bytes_sent '
                      '"$http_referer" "$http_user_agent"';

# Adding users by login name
map $ssl_client_s_dn $loggable {
    default 1;
}

server {
   listen 443 ssl;
   http2 on;

   access_log /var/log/nginx/access.log ssl_client;

   charset utf-8;
   client_max_body_size        500M;

   proxy_connect_timeout       30;
   proxy_send_timeout          600;
   proxy_read_timeout          600;
   send_timeout                600;
   keepalive_timeout           600;

   ssl_certificate             /ssl/camunda.crt;
   ssl_certificate_key         /ssl/camunda.key;
   ssl_dhparam                 /ssl/dhparam.pem;
   ssl_ciphers                 ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
   ssl_protocols               TLSv1.3 TLSv1.2;

   # two factor auth with etoken
#   ssl_client_certificate      /ssl/trustedclient.crt;
#   ssl_verify_client           optional; 
   # we are setting 10 minute timeout, if etoken removed browser can use session key during 10 minutes and then return 403 Forbidden
#   ssl_session_timeout         600;

   add_header                  Strict-Transport-Security 'max-age=31536000; includeSubDomains';
   ssl_prefer_server_ciphers   on;
   ssl_session_cache           shared:SSL:10m;
   proxy_ssl_session_reuse     on;

#   allow 127.0.0.1;
#   allow 192.168.106.1; # docker local network
#   deny all;

   location / {
#      if ($ssl_client_verify != "SUCCESS") { return 401; }
#      if ($loggable != 1 ) { return 403; }

      proxy_pass http://pgadmin;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_http_version 1.1;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header Host $http_host;      
      proxy_redirect off;      
   }
}