upstream vaultwarden_upstream {
  server vaultwarden-server:80;
  keepalive 2;
}

map $http_upgrade $connection_upgrade {
  default upgrade;
  ''      "";
}

server {
  listen 8080;
  server_name _;

  client_max_body_size 525M;
  proxy_http_version 1.1;
  proxy_set_header Host              $host;
  proxy_set_header X-Real-IP         $remote_addr;
  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-Proto $scheme;
  proxy_set_header Upgrade           $http_upgrade;
  proxy_set_header Connection        $connection_upgrade;

  location /admin {
    allow 172.30.0.0/24;
    deny  all;
    proxy_pass http://vaultwarden_upstream;
  }

  location / {
    proxy_pass http://vaultwarden_upstream;
  }
}