upstream docservice {
# Указать все сервера с DS
  server {{ DS_CLUSTER_HOST_1 | last }};
  server {{ DS_CLUSTER_HOST_2 | last }};
  server {{ DS_CLUSTER_HOST_3 | last }};
}
 
map $http_host $this_host {
  "" $host;
  default $http_host;
}
 
map $http_x_forwarded_proto $the_scheme {
  default $http_x_forwarded_proto;
  "" $scheme;
}
 
map $http_x_forwarded_host $the_host {
  default $http_x_forwarded_host;
  "" $this_host;
}
 
map $http_upgrade $proxy_connection {
  default upgrade;
  "" close;
}
 
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Forwarded-Host $the_host;
proxy_set_header X-Forwarded-Proto $the_scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 
## Normal HTTP host
server {
  listen 0.0.0.0:80;
  server_name {{ DS_FRONTEND_PREFIX_DOCSERVER | last }}.{{ DS_FRONTEND_DOMAIN | last }};
  server_tokens off;
 
## Redirects all traffic to the HTTPS host
  return 301 https://$server_name:443$request_uri;
}
 
server {
  listen 0.0.0.0:443 ssl http2;
  server_name {{ DS_FRONTEND_PREFIX_DOCSERVER | last }}.{{ DS_FRONTEND_DOMAIN | last }};
  server_tokens off;
  root /usr/share/nginx/html;
 
  ssl_certificate /etc/nginx/ssl/fullchain.crt;
  ssl_certificate_key /etc/nginx/ssl/privkey.key;
 
  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
 
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
  ssl_session_cache builtin:1000 shared:SSL:10m;
 
  ssl_prefer_server_ciphers on;
 
## [Optional] Before enabling Strict-Transport-Security headers, ensure your server is properly configured for SSL.
## This directive informs the browser to always use HTTPS. For more info see:
## - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# add_header X-Frame-Options SAMEORIGIN;
  add_header X-Content-Type-Options nosniff;
 
location / {
  proxy_pass http://docservice;
  proxy_http_version 1.1;
  }
}
