nginx.conf

events {
  worker_connections  4096;  ## Default: 1024
}
pid        /var/cache/nginx/nginx.pid;
http {
    server {
        listen                      443 ssl;
        server_name                 localhost;
        root                        /usr/share/nginx/html;
        client_max_body_size        100M;

        
        ssl_certificate             /etc/nginx/cert.pem;
        ssl_certificate_key         /etc/nginx/privkey.pem;
        ssl_prefer_server_ciphers   on;
        
        ssl_client_certificate      /etc/nginx/dod-certs.pem;
        ssl_verify_client           optional;
        ssl_verify_depth            4;
        
        error_log                   /var/log/nginx/error.log debug;

        if ($return_unauthorized) { return 496; }

        location / {
            autoindex on;
            ssi on;
        }
        location /stigman/ {
            proxy_pass              http://stigman:54000/;
        }
        location /kc/ {
            proxy_pass              http://keycloak:8080/;
            proxy_set_header        Host               $host;
            proxy_set_header        X-Real-IP          $remote_addr;
            proxy_set_header        X-Forwarded-For    $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Host   $host;
            proxy_set_header        X-Forwarded-Server $host;
            proxy_set_header        X-Forwarded-Port   $server_port;
            proxy_set_header        X-Forwarded-Proto  $scheme;
            proxy_set_header        ssl-client-cert    $ssl_client_escaped_cert;
            proxy_buffer_size       128k;
            proxy_buffers           4 256k;
            proxy_busy_buffers_size 256k;
        }
    }

    # define which endpoints require mTLS
    map_hash_bucket_size 128;
    map $uri $secured_url {
        default false;
        "/kc/realms/stigman/protocol/openid-connect/auth" true;
    }

    map "$secured_url:$ssl_client_verify" $return_unauthorized {
            default 0;
            "true:FAILED" 1;
            "true:NONE" 1;
            "true:" 1;
    }
}