nginx.conf.j2

load_module /usr/lib64/nginx/modules/ngx_stream_module.so;

worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}

http {
    map_hash_bucket_size 128;
    map_hash_max_size 128;
    server_names_hash_bucket_size  128;
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;

    server {
      listen 8080 default_server;
      server_name _;
      return 301 https://$host$request_uri;
    } 

}


stream {  

  map_hash_bucket_size 128;
  map $ssl_server_name $targetBackend {
{% if rekor_enabled %}
    rekor.{{ base_hostname }}  rekor-server-pod:3000;
{% endif %}
{% if tuf_enabled %}
    tuf.{{ base_hostname }}  tuf-pod:8080;
{% endif %}
{% if fulcio_enabled %}
    fulcio.{{ base_hostname }}  fulcio-server-pod:5555;
{% endif %}
  }

  map $ssl_server_name $targetCert {
{% if rekor_enabled %}
    rekor.{{ base_hostname }} /certs/ingress-rekor.pem;
{% endif %}
{% if tuf_enabled %}
    tuf.{{ base_hostname }} /certs/ingress-tuf.pem;
{% endif %}
{% if fulcio_enabled %}
    fulcio.{{ base_hostname }} /certs/ingress-fulcio.pem;
{% endif %}
  }

  map $ssl_server_name $targetCertKey {
{% if rekor_enabled %}
    rekor.{{ base_hostname }}  /certs/ingress-rekor.key;
{% endif %}
{% if tuf_enabled %}
    tuf.{{ base_hostname }}  /certs/ingress-tuf.key;
{% endif %}
{% if fulcio_enabled %}
    fulcio.{{ base_hostname }}  /certs/ingress-fulcio.key;
{% endif %}
  }
  
  server {
    listen 8443 ssl;
    ssl_protocols       TLSv1.2;
    ssl_certificate     $targetCert;
    ssl_certificate_key $targetCertKey;
        
    proxy_connect_timeout 1s;
    proxy_timeout 3s;
    resolver {{ dns_resolver }} ipv6=off;
      
    proxy_pass $targetBackend;
  }

}