ingress.conf

user nginx;
worker_processes 4;
pid /run/nginx.pid;

events {
    worker_connections  4000;
    use epoll;
    multi_accept on;
}

http {
    proxy_cache_path  /var/cache/nginx levels=1:2 keys_zone=one:8m max_size=3000m inactive=600m;
    proxy_temp_path /var/tmp;
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout  65;
    keepalive_requests 100000;

    fastcgi_buffers 16 16k;
    fastcgi_buffer_size 32k;

    client_body_buffer_size      128k;
    client_header_buffer_size    9k;
    output_buffers               1 32k;
    postpone_output              1460;

    client_header_timeout  3m;
    client_body_timeout    3m;
    send_timeout           3m;

    gzip on;
    gzip_comp_level 6;
    gzip_vary on;
    gzip_min_length  1000;
    gzip_proxied any;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;
    gzip_buffers 16 8k;

    open_file_cache max=1000 inactive=20s;
    open_file_cache_valid 30s;
    open_file_cache_min_uses 5;
    open_file_cache_errors off;

    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    upstream client_server {
        server client:80 max_fails=0 fail_timeout=5s;
        keepalive 64;
    }

    upstream api_server {
        server api:9999 max_fails=0 fail_timeout=5s;
        keepalive 64;
    }

    server {
        listen 80;
        listen [::]:80;
        server_name _;

        location ~ ^/status$ {
            stub_status;
        }

        location / {
            return 301 https://$host:8443$request_uri;
        }
    }

    server {
        listen 443 ssl http2;
        server_name _;

        ssl on;
        ssl_certificate /etc/ssl/server.crt;
        ssl_certificate_key /etc/ssl/server.key;
        ssl_session_timeout 1d;
        ssl_session_cache shared:SSL:20m;
        ssl_session_tickets off;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';

        ssl_stapling on;
        ssl_stapling_verify on;

        ssl_trusted_certificate /etc/ssl/server.crt;

        error_page  497 https://$host:8443$request_uri;

        location ~ ^/yolo/api/v2(.*)$ {
            proxy_redirect off;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   Host              $http_host;
            proxy_set_header   X-NginX-Proxy     true;
            proxy_http_version 1.1;
            proxy_cache one;
            proxy_cache_key sfs$request_uri$scheme;
            proxy_pass         http://api_server/api/v2$1$is_args$args;

            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }

        location /yolo/__webpack_hmr {
            proxy_pass http://client_server;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection “upgrade”;
        }

        location /yolo/  {
            proxy_redirect off;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   Host              $http_host;
            proxy_set_header   X-NginX-Proxy     true;
            proxy_set_header   Connection "";
            proxy_http_version 1.1;
            proxy_cache one;
            proxy_cache_key sfs$request_uri$scheme;
            proxy_pass         http://client_server/yolo;

            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "";
        }
    }
}