# nginx recipe: the protected API is reached only with a valid TrustPin
# attestation token. Needs the njs module (included in the official nginx
# images). Replace the set values and the two upstreams with your own.
load_module modules/ngx_http_js_module.so;

error_log /dev/stderr warn;   # shows why a token was refused

events {}

http {
    js_path /etc/nginx/njs/;
    js_import trustpin from trustpin_attest.js;
    # The JWKS, shared by all workers. Entries expire after an hour without
    # use; the check refreshes the JWKS every 5 minutes while in use.
    js_shared_dict_zone zone=trustpin_jwks:1m timeout=1h;
    resolver 127.0.0.11 valid=30s;   # Docker's DNS; use your own resolver

    upstream api { server issuer:18300; }        # your API
    upstream trustpin_verifier { server issuer:18300; }  # your verifier

    server {
        listen 8080;

        set $trustpin_issuer   "https://attest.example.com";
        set $trustpin_audience "tprn::project::org_example::prj_example";
        # Expected tp.prj; empty means the audience above when it is a
        # tprn::project:: name. Set it when you use a custom audience.
        set $trustpin_project "";
        # "on" refuses tokens without bind; use it when your attestation
        # policy sets tokens.binding: required.
        set $trustpin_require_bind off;

        location / {
            auth_request /_trustpin_check;
            auth_request_set $trustpin_sub $upstream_http_x_trustpin_sub;
            proxy_set_header X-TrustPin-Sub $trustpin_sub;
            proxy_pass http://api;
        }

        location = /_trustpin_check {
            internal;
            js_content trustpin.verify;
        }

        # The JWKS, fetched by the check: at most once per 30 s, giving up
        # after 5 s.
        location = /_trustpin_jwks {
            internal;
            proxy_connect_timeout 5s;
            proxy_send_timeout 5s;
            proxy_read_timeout 5s;
            proxy_pass http://trustpin_verifier/.well-known/jwks.json;
        }
    }
}