upstream morpheus_http  {
    ip_hash;
    server 192.168.213.13:8080;
#    keepalive  4;
}

upstream morpheus_https {
    ip_hash;
    server 192.168.213.13:443;
#    keepalive  4;
}

map     $host:$request_uri $bad_request {
    default                                     0;
    "~*^195\.x\.x\.x:/app3/.*"       0;
    "~*^195\.x\.x\.x:.*"                  1;
}

server  {
    listen              80;
    server_name         morpheus.xxx.ru 195.xxx.xxx.xxx;

    rewrite             ^  https://$host$request_uri  permanent;
}

limit_conn_zone         $binary_remote_addr zone=limit_conn_morpheus:5m;
limit_req_zone          $binary_remote_addr zone=limit_req_morpheus:10m rate=20r/s;

proxy_cache_path        /var/cache/nginx/morpheus levels=1:2 use_temp_path=off keys_zone=morpheus_cache:20m max_size=256m;

server  {
    listen              443 ssl;
    server_name         morpheus.xxx.ru 195.xxx.xxx.xxx;

    include             err_page/*.conf;
    include             checks/log_bad_access;

    limit_conn          limit_conn_morpheus 50;
    limit_req           zone=limit_req_morpheus burst=80;
    limit_conn_log_level error;
    limit_req_log_level  warn;

    access_log          /var/log/nginx/morpheus_access.log main;
    error_log           /var/log/nginx/morpheus_error.log warn;

    ssl_certificate     ssl/morpheus-cert.pem;
    ssl_certificate_key ssl/morpheus-key.pem;
    ssl_dhparam         ssl/dh2048.pem;

    ssl_session_cache   shared:SSL_morpheus:2m;

    proxy_bind          $remote_addr transparent;

    proxy_cache         morpheus_cache;

    location ^~ /app2/        {
        include         checks/ret_bad_access;
        proxy_pass       https://morpheus_https; 
    }

    location /  {
        if ($bad_request)       {
            return      403;
        }
        include         checks/ret_bad_access;
        proxy_pass       http://morpheus_http; 
    }
}

error_page      502 504 /errors/temp_unavail.html;

error_page      403 /errors/forbidden.html;

location ~ ^/errors/([^/]*\.html)$      {
    alias       err_page/$1;
    allow all;
    internal;
}

include checks/*.map;

map $bad_ip             $bad_ip_str     {
    "1"                 "Bad IP";
}
map $bad_ua             $bad_ua_str     {
    "1"                 "Bad User Agent";
}
map $bad_location       $bad_location_str       {
    "1"                 "Bad Location";
}
map $bad_referer        $bad_referer_str        {
    "1"                 "Bad Referer";
}
map "$bad_ip:$bad_ua:$bad_location:$bad_referer"        $error_access   {
    "~^1"               $bad_ip_str;
    "~^.:1"             $bad_ua_str;
    "~^.:.:1"           $bad_location_str;
    "~^.:.:.:1"         $bad_referer_str;
}
map $bad_ip:$error_access       $add_bad_ip     {
    default             "1";
    "0:"                "0";
#    "~^1:"             "0";
}

access_log      /var/log/nginx/access_error.log error_access_format if=$error_access;
access_log      checks/bad_ip.list deny_log_format if=$add_bad_ip;

if ($error_access)      {
    return      403;
}

upstream morpheus_xxx      {
    hash $remote_addr consistent;
    server  192.168.213.13:9094;
}

limit_conn_zone $binary_remote_addr zone=limit_conn_stream_9094:10m;

server      {
    listen          9094;

    limit_conn      limit_conn_stream_9094 20;
    limit_conn_log_level error;

    access_log      /var/log/nginx/stream_9094_access.log stream;
    error_log       /var/log/nginx/stream_9094_error.log warn;

    proxy_bind      $remote_addr transparent;

    proxy_pass      morpheus_xxx;
}