proxy_cache_path /var/www/cache levels=1:2 keys_zone=backcache:8m max_size=1000m inactive=600m;
proxy_temp_path /var/www/cache/tmp;

server {
  listen *:80;
  server_name <%= issuer %>;
  return 301 https://$server_name$request_uri;
}

server {

  listen       *:443;
  server_name  <%= issuer %>;

  # Set up SSL
  ssl on;

  ssl_session_cache shared:SSL:1m;
  ssl_session_timeout  5m;

  ssl_certificate /etc/nginx/certs/nginx.crt;
  ssl_certificate_key /etc/nginx/certs/nginx.key;

  # Settings to avoid SSL warnings in browser
  ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;  # don’t use SSLv3 ref: POODLE
  ssl_prefer_server_ciphers on;
  ssl_ciphers "HIGH:!aNULL:!MD5 or HIGH:!aNULL:!MD5:!3DES";


  # Logging
  #access_log  /var/log/nginx/anvil.access.log  main; # could also put these into 1 file
  #error_log   /var/log/nginx/anvil.error.log  main;


  # Allow empty bodies
  client_max_body_size 0;


  # Reverse proxy to Connect
  location / {
    proxy_buffering off;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # untested, but taken from https://gist.github.com/nikmartin/5902176#file-nginx-ssl-conf-L25
    # and seems useful
    proxy_set_header X-NginX-Proxy true;
    proxy_read_timeout 5m;
    proxy_connect_timeout 5m;

    proxy_pass http://connect;
    proxy_redirect off;

    # Static files
    location ~* .+\.(ico|jpe?g|gif|css|js|flv|png|swf)$ {
      # http context
      proxy_cache backcache;
      proxy_buffering on;
      proxy_cache_min_uses 1;
      proxy_ignore_headers Cache-Control;
      proxy_cache_use_stale updating;
      #proxy_cache_key "$scheme$request_method$host$request_uri$is_args$args";
      proxy_cache_valid 200 302 60m;
      proxy_cache_valid 404 1m;

      proxy_pass http://connect;
    }
  }
}