nginx.conf

#user  nobody;
worker_processes  1;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;
error_log /usr/local/var/log/nginx/error.log;
#pid        logs/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;

    #gzip  on;

    server {
        # this block is for the cm.pekoe.io users. The subdomain IS obviously SET so no need to check. Just convert it to a proxy_set_header
        # OR maybe it's a general tenant block. But I can't test it here. Not with SSL set and nothing in my hosts file. Curl doesn't do it.
        # see the extended settings for ssl below.
        # https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
        listen 443;
        server_name *.pekoe.io;
        ssl on ;
        ssl_certificate      /etc/ssl/certs/myssl.crt;
        ssl_certificate_key  /etc/ssl/private/myssl.key;

        set $tenant 'none';
        # a simple test of this using ^(.*).local caused the tenant to be 'owl' - so this probably works.
        if ($host ~* ^(.*).pekoe.io$ ) {
            set $tenant $1;
        }

        location / {
            proxy_pass       http://localhost:9000;
            proxy_set_header Host      $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
        location /exist {
            proxy_pass http://127.0.0.1:8080/exist;
            proxy_set_header Host      $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header tenant $tenant; #### this is the key
            proxy_redirect http://owl.local https://owl.local;
        }
    }


# In this server block, the subdomain is obviously NOT SET. Need to check the $http_subdomain header. 
# to clarify. If someone hits this with a subdomain in the host, then they'll be handled ABOVE
# But without, they'll need to logon and choose.
# If for some reason, they are authenticated but don't have a subdomain, they'll need to choose again
# anyone with multiple subdomains will be shown the subdomain selector in the Bookmarks area.
# It might also be sensible to redirect a user with only one tenant to the correct url - but I can't do this in testing.
# BUT: how do I always send a custom header?

    server {
        listen 443;

        ssl on;
        ssl_certificate      /etc/ssl/certs/myssl.crt;
        ssl_certificate_key  /etc/ssl/private/myssl.key;
        
        # SEE https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
        # ssl_ciphers 'AES256+EECDH:AES256+EDH:!aNULL';

        # ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        # ssl_session_cache  builtin:1000  shared:SSL:10m;

        # ssl_stapling on;
        # ssl_stapling_verify on;
        # resolver 8.8.4.4 8.8.8.8 valid=300s;
        # resolver_timeout 10s;

        # ssl_prefer_server_ciphers on;
        # ssl_dhparam /etc/ssl/certs/dhparam.pem;

        # add_header Strict-Transport-Security max-age=63072000;
        # add_header X-Frame-Options DENY;
        # add_header X-Content-Type-Options nosniff;

        server_name  localhost owl.local;   

        location / {
            proxy_pass       http://localhost:9000;
            proxy_set_header Host      $host;
            proxy_set_header X-Real-IP $remote_addr;
        }

        # location /livereload {
        #     proxy_pass http://localhost:35729;
        #     proxy_http_version 1.1;
        #     proxy_set_header Upgrade $http_upgrade;
        #     proxy_set_header Connection "Upgrade";
        # }

        # Ideally, tenant will be passed the subdomain in the host header.
        # Not sure how to handle this for testing. Create a param here if the subdomain is NOT set?
        # MUST have the subdomain set or else redirect.

        set $tenant "none";


        # if a tenant header is set
        if ($http_tenant) {
            set $tenant $http_tenant;
        }
    

        
        location /exist {
            proxy_pass       http://localhost:8080/exist;
            proxy_set_header Host      owl.local;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header tenant $tenant;
            proxy_redirect http://owl.local https://owl.local;
        }
        #error_page  404              /404.html;

        # redirect server error pages to the static page /50x.html
        #
        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }

        # proxy the PHP scripts to Apache listening on 127.0.0.1:80
        #
        #location ~ \.php$ {
        #    proxy_pass   http://127.0.0.1;
        #}

        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
        #
        #location ~ \.php$ {
        #    root           html;
        #    fastcgi_pass   127.0.0.1:9000;
        #    fastcgi_index  index.php;
        #    fastcgi_param  SCRIPT_FILENAME  /scripts$fastcgi_script_name;
        #    include        fastcgi_params;
        #}

        # deny access to .htaccess files, if Apache's document root
        # concurs with nginx's one
        #
        #location ~ /\.ht {
        #    deny  all;
        #}
    }


    # another virtual host using mix of IP-, name-, and port-based configuration
    #
    #server {
    #    listen       8000;
    #    listen       somename:8080;
    #    server_name  somename  alias  another.alias;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}


    # HTTPS server
    #
    #server {
    #    listen       443 ssl;
    #    server_name  localhost;

    #    ssl_certificate      cert.pem;
    #    ssl_certificate_key  cert.key;

    #    ssl_session_cache    shared:SSL:1m;
    #    ssl_session_timeout  5m;

    #    ssl_ciphers  HIGH:!aNULL:!MD5;
    #    ssl_prefer_server_ciphers  on;

    #    location / {
    #        root   html;
    #        index  index.html index.htm;
    #    }
    #}

}