ansible-role-ejabberd/templates/nginx_http_upload_proxy.conf.j2

server {
        listen {{ nginx_listen_http }};
        listen [::]:{{ nginx_listen_https }};
        server_name {{ ejabberd_http_upload_host | replace('@HOST@', item) }};
        return 301 https://{{ ejabberd_http_upload_host | replace('@HOST@', item) }}$request_uri;
}

server {
        listen {{ nginx_listen_https }} ssl http2;
        listen [::]:{{ nginx_listen_https }} ssl http2;

        server_name {{ ejabberd_http_upload_host | replace('@HOST@', item) }};

        client_max_body_size 5G;

        ssl_certificate /etc/letsencrypt/live/{{ ejabberd_letsencrypt_cert }}/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/{{ ejabberd_letsencrypt_cert }}/privkey.pem;
        ssl_trusted_certificate /etc/letsencrypt/live/{{ ejabberd_letsencrypt_cert }}/fullchain.pem;

        location / {
                proxy_set_header        Host $host;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto $scheme;
                proxy_pass              http://localhost:{{ ejabberd_http_upload_port }};
        }

        # allow cross domain access (especially important for web clients)
        add_header Access-Control-Allow-Origin *;
        add_header Access-Control-Allow-Methods "OPTIONS, HEAD, GET, PUT";
        add_header Access-Control-Allow-Headers "Authorization, Content-Type";
        add_header Access-Control-Allow-Credentials true;
}