upstream app {
    server localhost:9000 fail_timeout=0;
}

upstream hook {
    server 127.0.0.1:7000 fail_timeout=0;
}

upstream tusd {
    server localhost:8000 fail_timeout=0;
}

server {
    include listen;

    proxy_headers_hash_max_size 1024;
    proxy_headers_hash_bucket_size 128;

    large_client_header_buffers 4 32k;

    location / {
        include proxy_params;
        include auth/allow_yandex_only;             # in order to restrain access from external IPs
                                                    # in case this location will be exposed
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_intercept_errors on;

        proxy_pass http://app;
        proxy_next_upstream error;
    }

    location /upload {
        include proxy_params;
        proxy_set_header X-Forwarded-Proto "https";  # we need this in order to generate correct Location
                                                     # header in tusd server
        proxy_intercept_errors on;

        client_max_body_size 100m;

        proxy_pass http://tusd;
        proxy_next_upstream error;
    }

    location /ping {
        include auth/allow_yandex_only;
        include proxy_params;
        proxy_intercept_errors on;

        proxy_pass http://app;
        proxy_next_upstream error;
    }

    location /tusd-hook {
        allow 127.0.0.1;
        deny all;

        include proxy_params;
        proxy_intercept_errors on;

        proxy_pass http://hook;
        proxy_next_upstream error;
    }
}
