ansible-infra/playbooks/files/chaosknoten/configs/public-reverse-proxy/nginx/acme_challenge.conf

map $host $upstream_acme_challenge_host {
    cloud.hamburg.ccc.de cloud-intern.hamburg.ccc.de:31820;
    pad.hamburg.ccc.de pad-intern.hamburg.ccc.de:31820;
    id.ccchh.net 172.31.17.144:31820;
    keycloak-admin.ccchh.net 172.31.17.144:31820;
    default "";
}

server {
    listen 80 default_server;

    location /.well-known/acme-challenge/ {
        proxy_pass http://$upstream_acme_challenge_host;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        # This is http in any case.
        proxy_set_header X-Forwarded-Proto http;
    }

    # Better safe than sorry.
    # Don't do a permanent redirect to avoid acme challenge pain (even tho 443
    # still should work).
    location / {
        return 307 https://$host$request_uri;
    }
}