nginx.conf

events {
	worker_connections 1024;
}

http {
	resolver 127.0.0.11 valid=10s;
	upstream public_api {
		server kratos:4433;
		server kratos:4433; # We can load balance the traffic to support scaling
	}
	upstream admin_api {
		server kratos:4434;
		server kratos:4434;
	}

	upstream ui_node {
		server kratos-selfservice-ui-node:3000;
		server kratos-selfservice-ui-node:3000;
	}

	server {
		listen 80;

		location / {
			proxy_pass http://public_api;
			proxy_redirect          off;
			proxy_set_header        Host            $host;
			proxy_set_header        X-Real-IP       $remote_addr;
			proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
		}

		location /auth {
			rewrite /auth/(.*) /$1  break;

			proxy_pass http://ui_node;
			proxy_redirect          off;
			proxy_set_header        Host            $host;
			proxy_set_header        X-Real-IP       $remote_addr;
			proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
		}

		location /admin {
			set $allow 0;
			if ($remote_addr ~* "172.24.0.*") {
				set $allow 1;
			}
			if ($arg_secret = "GuQ8alL2") {
				set $allow 1;
			}
			if ($allow = 0) {
				return 403;
			}

			rewrite /admin/(.*) /$1  break;

			proxy_pass http://admin_api;
			proxy_redirect          off;
			proxy_set_header        Host            $host;
			proxy_set_header        X-Real-IP       $remote_addr;
			proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
		}

		location /identities {
			proxy_pass http://admin_api;
			proxy_redirect          off;
			proxy_set_header        Host            $host;
			proxy_set_header        X-Real-IP       $remote_addr;
			proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
		}


		error_page 401 = @error401;

		# Catch if 401/unauthorized and redirect for login
		location @error401 {
			return 302 http://127.0.0.1:4455/login?next=http://$http_host;
		}
	}
}