# Keep resource tickets and query strings out of proxy logs.
map $uri $rawmark_dev_log_path {
  ~^/api/v1/resources/[^/]+(?<rawmark_dev_suffix>/.*)$ /api/v1/resources/[redacted]$rawmark_dev_suffix;
  default $uri;
}
log_format rawmark_dev '$remote_addr - $remote_user [$time_local] '
  '"$request_method $rawmark_dev_log_path $server_protocol" $status $body_bytes_sent '
  '"$http_user_agent"';

server {
  listen 80;
  server_name raw-dev.134333.xyz;
  access_log /var/log/nginx/raw-dev.134333.xyz.log rawmark_dev;
  error_log /dev/null;
  return 308 https://$host$request_uri;
}
server {
  listen 443 ssl;
  http2 on;
  server_name raw-dev.134333.xyz;
  include /etc/nginx/snippets/ssl-134333.xyz.conf;
  include /etc/nginx/snippets/no-spider.conf;
  access_log /var/log/nginx/raw-dev.134333.xyz.log rawmark_dev;
  error_log /var/log/nginx/raw-dev.134333.xyz.error.log warn;
  client_max_body_size 0;

  location / {
    proxy_pass http://127.0.0.1:21001;
    proxy_http_version 1.1;
    proxy_request_buffering off;
    proxy_buffering off;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 1h;
    proxy_send_timeout 1h;

    # Error logs cannot redact ticket-bearing request paths.
    location ^~ /api/v1/resources/ {
      proxy_pass http://127.0.0.1:21001;
      error_log /dev/null;
    }
  }
}