upstream hass {
  server 192.168.1.6:8123;
}
upstream certbot {
  server 192.168.1.6:8081;
}
upstream z2m {
  server 192.168.1.6:8080;
}

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen    80;
    listen   443 ssl;
    server_name home-fnv.yandex5.ru;

    ssl_certificate        /config/keys/live/home-fnv.yandex5.ru/fullchain.pem;
    ssl_certificate_key    /config/keys/live/home-fnv.yandex5.ru/privkey.pem;

    #access_log off;
    location ~/.well-known/acme-challenge/(.*)$ {
        proxy_pass           http://certbot;
    }

    #access_log off;
    location /z2m {
        auth_basic           "Administrator’s Area";
        auth_basic_user_file conf.d/z2m_htpasswd; 

        proxy_pass http://192.168.1.6:8080/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    location /z2m/api {
        auth_basic           "Administrator’s Area";
        auth_basic_user_file conf.d/z2m_htpasswd; 

        proxy_pass         http://192.168.1.6:8080/api;
        proxy_set_header Host $host;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location / {
        real_ip_header X-Forwarded-For;
        set_real_ip_from 0.0.0.0/0;
    
        proxy_pass           http://hass;
        proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Host $remote_addr;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}