ssl_server_lb.conf

#
# Handle all requests to (non SSL) http.
#
server {
	server_name <load balancer API domain name> default_server;
	listen 80;
	root /var/www/html;

	location ~ ^/.well-known/acme-challenge* {
#		try_files $uri @go2https;
		access_log /var/log/nginx/acme_access_log;
		error_log /var/log/nginx/acme_error_log;
	}

        # Default location match - will drop all connections
        # immediately if not an acme request.  Comment this,
	# uncomment tri_files above and location block below
	# if you want to forward all  non-acme  requests  to
	# SSL port.
        location / {
                return 444;
        }

	# Mutually exclusive location to above. Redirects to SSL https
#	location @go2https {
#		rewrite ^ https://$server_name$request_uri? permanent;
#	}
}

#
# bts_tools web interface - with basic authentication
# NOTE: uses a different server name!
#
server {
	listen 443 ssl;
	server_name <bts_tools-domain.com>;

	ssl on;
	ssl_certificate /etc/nginx/ssl/certs/bts_tools.crt;
	ssl_certificate_key /etc/nginx/ssl/private/bts_tools.key;
        ssl_session_cache shared:SSL:1m;
	ssl_session_timeout 5m;

	# Alternate cipher specs. Many other possible as well.
#	ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
#	ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";
#	ssl_prefer_server_ciphers on;
#
        charset utf-8;
	location / { try_files $uri @bts_tools; }	
        location @bts_tools {
	        auth_basic "No Access Here!";
		auth_basic_user_file <your password list file>;
                include uwsgi_params;
		uwsgi_pass unix:<path to bts_tools uwsgi socket>;
	}
}

#
# Final destination for local websocket server (ws not wss)
#
upstream local_ws_svr {
    server localhost:<port>;
}

#
# This virtual host is used to translate wss into ws & proxy for local ws server
#
server {
        listen <local wss (not 443) port> ssl;
        server_name <public-api-domain.com (public non-load balanced wss)>;

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        keepalive_requests 25000;

        ssl on;
        ssl_certificate /etc/nginx/ssl/certs/server.crt;
        ssl_certificate_key /etc/nginx/ssl/private/server.key;
        ssl_session_cache shared:SSL:1m;
        ssl_session_timeout 5m;

        #
        # Default location match - will drop all connections
        # immediately if websocket location below fails to match.
        location / {
                return 444;
        }

        # Matches websocket URL address
        location ~ ^/wss$ {
                limit_req zone=ws burst=5;

                proxy_http_version 1.1;
                #proxy_connect_timeout 2;
                proxy_pass http://local_ws_svr;

                proxy_set_header Host $host;
                proxy_set_header Connection "upgrade";
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                #proxy_next_upstream error timeout invalid_header http_500;
        }
}

#
# Proxy / load balancer for public websocket API.
#
# NOTE: the other servers also proxy wss to ws
upstream websockets {
    server localhost:<local wsS port used above>
    server 2.2.2.2:443
    server 3.3.3.3:443
    server 4.4.4.4:443
    server 5.5.5.5:443
}

#
# Virtual host for load balanced wss websocket public API
#
server {
	listen 443 ssl;
        server_name <public-api-domain.com (load balanced)>;

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	keepalive_requests 100000;

	ssl on;
	ssl_certificate /etc/nginx/ssl/certs/server.crt;
	ssl_certificate_key /etc/nginx/ssl/private/server.key;
        ssl_session_cache shared:SSL:1m;
	ssl_session_timeout 5m;

	# Provided to verify https certificate is working
        location ~ ^/.well-known/acme-challenge* {
		root /var/www/html;
                access_log /var/log/nginx/acme_access_log;
                error_log /var/log/nginx/acme_error_log;
		break;
        }

	#
	# Default location match - will drop all connections
	# immediately if the other location blocks fail to match.
	location / {
		return 444;
	}

	# Matches websocket URL address
	location ~ ^/wss$ {
		limit_req zone=ws burst=5;

	        proxy_http_version 1.1;
		proxy_connect_timeout 2;
		proxy_pass https://websockets;

		proxy_set_header Host $host;
		proxy_set_header Connection "upgrade";
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

		proxy_next_upstream error timeout invalid_header http_500;
	}
}