# nginx in front of two instances of a Littoral application, a on 8081 and
# b on 8082, for deploys that keep sessions (handover.sh).  Nothing here
# changes from one deploy to the next:
# - a request whose session key starts a. goes to a, or to b once a has
#   gone (b then starts it a new session, and an AUTH-ROOT signs it back in);
# - any other request goes to either, and one a draining instance refuses
#   (503) is retried on the other.

map $http_upgrade $connection_upgrade { default upgrade; '' close; }

upstream bookshop_a   { server 127.0.0.1:8081; server 127.0.0.1:8082 backup; }
upstream bookshop_b   { server 127.0.0.1:8082; server 127.0.0.1:8081 backup; }
upstream bookshop_any { server 127.0.0.1:8081; server 127.0.0.1:8082; }

# URL sessions carry the key in _s.  With cookie sessions, map the cookie
# instead: it is named _s and the application's path with / as _, so an
# application at /shop uses $cookie__s_shop.
map $arg__s $bookshop_upstream {
    ~^a\.   bookshop_a;
    ~^b\.   bookshop_b;
    default bookshop_any;
}

server {
    listen 80;
    server_name bookshop.example.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    http2 on;
    server_name bookshop.example.org;
    ssl_certificate     /etc/letsencrypt/live/bookshop.example.org/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bookshop.example.org/privkey.pem;

    client_max_body_size 10m;              # match *max-request-size*

    location / {
        proxy_pass http://$bookshop_upstream;
        # A refused connection (an instance that has exited), or a 503 from
        # one that is draining, is retried on the other instance.
        proxy_next_upstream error timeout http_503;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_buffering off;
        proxy_read_timeout 1h;
    }
}