server {
  # This serves:
  #   - `apt.cluster` internally.
  #   - `apt.production.alphagov.co.uk` externally.
  server_name apt.* apt-origin.*;
  root <%= @root_dir -%>/public;

  access_log /var/log/nginx/apt-access.log timed_combined;
  access_log /var/log/nginx/apt-json.event.access.log json_event;
  error_log /var/log/nginx/apt-error.log;

  location / {
    autoindex on;
  }
}

server {
  # This serves:
  #   - `apt.cluster` internally.
  #   - `apt.production.alphagov.co.uk` externally.
  server_name apt.* apt-origin.*;
  root <%= @root_dir -%>/public;

  <% if @real_ip_header != '' -%>
    # Use an unspoofable header from an upstream CDN or L7 load balancer
    real_ip_header <%= @real_ip_header -%>;
    set_real_ip_from 0.0.0.0/0;
  <% end -%>

  access_log /var/log/nginx/apt-access.log timed_combined;
  access_log /var/log/nginx/apt-json.event.access.log json_event;
  error_log /var/log/nginx/apt-error.log;

  location / {
    autoindex on;
  }
}

Allow use of RealIpModule if enabled in Nginx
Allow use of RealIpModule if enabled in Nginx

The Nginx RealIpModule allows us to log the value of the X-True-Client-IP
header as the IP we appear to receive requests from in the Nginx logs. This
is important as otherwise we see all requests as coming from the CDN edge.
The value of `set_real_ip_from` is set to 0.0.0.0/0 because we don't need to
restrict which hosts can send us True-Client-IP right now. If we need to
in future, that's where we'll do it.

This will only run where `real_ip_header` is set in Hiera; without a value,
it won't run.

The VCL in Fastly sorts the passing of the client's real IP through to this
header. See
https://github.gds/gds/cdn-configs/blob/master/fastly/vcl_templates/apt.vcl.erb#L34
for details.

To test this works, I span up `apt-1` in Vagrant (10.0.2.15), and then used
`curl -ivk -H "X-True-Client-IP: 1.1.1.1" http://10.0.2.15` from my local
machine. This produced:

1.1.1.1 - - [12/Nov/2014:10:04:02 +0000]  "GET / HTTP/1.1" 404 162 "-"
"curl/7.30.0" 0.014 - - - - 10.0.2.15

in the Nginx access logs.

To check that it actually worked, I then changed the value of the
X-True-Client-IP header to 2.2.2.2, and ended up with:

2.2.2.2 - - [12/Nov/2014:10:06:10 +0000]  "GET / HTTP/1.1" 404 162 "-"
"curl/7.30.0" 0.008 - - - - 10.0.2.15

Now happy that this works.
