nginx.conf

## NEED CHANGE (defines the user of the nginx workers)
# user user group;

## THIS PARAMETERS BE SAFELY OVER RIDDEN BY YOUR DEFAULT NGINX CONF
worker_processes  2;

error_log stderr debug;
env REDISTOGO_URL;

daemon off;

events {
  worker_connections 256;
}

http {
  lua_shared_dict api_keys 10m;
  lua_package_path ";;$prefix/?.lua;";
  init_by_lua 'math.randomseed(ngx.time())';

  resolver 8.8.8.8;

  upstream backend_address-book-app.herokuapp.com {
    server address-book-app.herokuapp.com:443 max_fails=5 fail_timeout=30;
  }

  upstream threescale_backend {
    server su1.3scale.net:80; #su1.3scale.net:80; #
  }

  server {
    lua_code_cache off;
    listen ${{PORT}};
    ## CHANGE YOUR SERVER_NAME TO YOUR CUSTOM DOMAIN OR LEAVE IT BLANK IF ONLY HAVE ONE
    server_name address-book-app-api-gateway.herokuapp.com;
    underscores_in_headers on;

    location /authorize {
      set $red_url "";
      set $client_id "";
      set $login_url "https://address-book-app.herokuapp.com/static_pages/authorize";
      set $service_id 2555417686521;
      proxy_set_header  Content-Type "application/x-www-form-urlencoded";
      content_by_lua_file authorize.lua;
    }

    location = /_threescale/oauth_store_token {
      internal;
      proxy_set_header  X-Real-IP  $remote_addr;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  Host "su1.3scale.net"; #needed. backend discards other hosts
      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";
      set $service_id 2555417686521;
      proxy_pass http://threescale_backend/services/$service_id/oauth_access_tokens.xml;
    }

    location = /_threescale/redirect_uri_matches {
      internal;
      proxy_set_header  X-Real-IP  $remote_addr;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  Host "su1.3scale.net"; #needed. backend discards other hosts
      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";
      set $service_id 2555417686521;
      proxy_pass http://threescale_backend/transactions/oauth_authorize.xml?provider_key=$provider_key&service_id=$service_id&app_id=$client_id&redirect_url=$red_url;
    }

    location /_threescale/toauth_authorize {
      proxy_set_header  X-Real-IP  $remote_addr;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  Host "su1.3scale.net" ;

      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";
      set $service_id 2555417686521;
      proxy_ignore_client_abort on;
      proxy_pass http://threescale_backend/transactions/oauth_authorize.xml?provider_key=$provider_key&access_token=$arg_access_token&$usage;
    }

    location /_threescale/oauth_report {
      internal;
      proxy_set_header  X-Real-IP  $remote_addr;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  Host "su1.3scale.net";
      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";
      set $service_id 2555417686521;
      proxy_pass http://threescale_backend/transactions.xml?provider_key=$provider_key&service_id=$service_id&transactions[0][access_token]=$arg_access_token&$usage;
    }

    location /callback {
      set $service_id 2555417686521;
      content_by_lua_file 'authorized_callback.lua';
    }

    location /oauth/token  {
      proxy_set_header  X-Real-IP  $remote_addr;
      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header  Host $http_host;
      proxy_set_header  Content-Type "application/x-www-form-urlencoded";
      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";
      content_by_lua_file get_token.lua ;
    }


    location = /threescale_authrep {
      internal;
      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";
      proxy_pass http://threescale_backend/transactions/authrep.xml?provider_key=$provider_key&service_id=$service_id&$usage&$credentials;
      proxy_set_header  Host  "su1.3scale.net";
    }

    location = /out_of_band_authrep_action {
      internal;
      proxy_pass_request_headers off;
      ##set $provider_key "YOUR_3SCALE_PROVIDER_KEY";
      ##needs to be in both places, better not to have it on location / for potential security issues, req. are internal
      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";

      content_by_lua '
        if ngx.var.cached_key ~= nil then
          local res1 = ngx.location.capture("/threescale_authrep", { share_all_vars = true })
          if res1.status ~= 200 then
            local api_keys = ngx.shared.api_keys
            api_keys:delete(ngx.var.cached_key)
          end

          ngx.status = 200
          ngx.header.content_length = 0
          ngx.exit(ngx.HTTP_OK)
        else
          ngx.status = 200
          ngx.header.content_length = 0
          ngx.exit(ngx.HTTP_OK)
        end
      ';
    }

    location = /out_of_band_oauth_report_action {
      internal;
      proxy_pass_request_headers off;
      set $provider_key "${{THREESCALE_PROVIDER_KEY}}";

      content_by_lua '
        if ngx.var.cached_key ~= nil then
          local res1 = ngx.location.capture("/_threescale/toauth_authorize?access_token="..ngx.var.access_token, { share_all_vars = true })
          if res1.status ~= 200 then
            local api_keys = ngx.shared.api_keys
            api_keys:delete(ngx.var.cached_key )
          else
            local res2 = ngx.location.capture("/_threescale/oauth_report?access_token="..ngx.var.access_token, {method = ngx.HTTP_POST, share_all_vars = true})
            ngx.status = 200
            ngx.header.content_length = 0
            ngx.exit(ngx.HTTP_OK)
          end
        else
          local res2 = ngx.location.capture("/_threescale/oauth_report?access_token="..ngx.var.access_token, {method = ngx.HTTP_POST, share_all_vars = true})
          ngx.status = 200
          ngx.header.content_length = 0
          ngx.exit(ngx.HTTP_OK)
        end
      ';
    }

    location / {
      set $provider_key null;
      set $cached_key null;
      set $credentials null;
      set $usage null;
      set $service_id 2555417686521;
      set $proxy_pass null;
      set $secret_token null;
      set $access_token null;

      proxy_ignore_client_abort on;

      ## CHANGE THE PATH TO POINT TO THE RIGHT FILE ON YOUR FILESYSTEM
      access_by_lua_file nginx.lua;

      proxy_pass $proxy_pass ;
      proxy_set_header  X-Real-IP  $remote_addr;
      proxy_set_header  Host  address-book-app.herokuapp.com;
      proxy_set_header X-3scale-proxy-secret-token $secret_token;

      post_action /out_of_band_oauth_report_action;
    }

    location ~* /api/(.*)/contacts.json {
      set $provider_key null;
      set $cached_key null;
      set $credentials null;
      set $usage null;
      set $service_id 2555417686521;
      set $proxy_pass null;
      set $secret_token "${{PROXY_SECRET_TOKEN}}";
      set $access_token null;

      set $api_path "/api/contacts.json?$args&username=$1";

      proxy_ignore_client_abort on;

      ## CHANGE THE PATH TO POINT TO THE RIGHT FILE ON YOUR FILESYSTEM
      access_by_lua_file nginx.lua;

      proxy_pass $proxy_pass$api_path ;
      proxy_set_header  X-Real-IP  $remote_addr;
      proxy_set_header  Host  address-book-app.herokuapp.com;
      proxy_set_header X-3scale-proxy-secret-token $secret_token;

      post_action /out_of_band_oauth_report_action;
    }
  }
}