user www-data;
worker_processes  1;

error_log /dev/stderr info;
pid /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    access_log /dev/stdout;
    sendfile on;
    keepalive_timeout  65;
    server_tokens off;

    server {
      listen 80;
      listen 443 ssl;

      ssl_protocols TLSv1.1 TLSv1.2;
      ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
      ssl_prefer_server_ciphers on;
      ssl_session_timeout 5m;
      ssl_session_cache shared:SSL:50m;
      ssl_certificate /certs/cert.pem;
      ssl_certificate_key /certs/key.pem;

      if ($scheme = http) {
    		return 301 https://$host$request_uri;
    	}

      location / {
        resolver 127.0.0.11;
        set $webmail_backend "http://webmail";
        proxy_pass $webmail_backend;
      }

      location /admin {
        resolver 127.0.0.11;
        set $admin_backend "http://admin";
        proxy_pass $admin_backend;
      }
    }
}