map $lmlocation $lmerror_location {
    ~^      $lmlocation;
    default @lmAuth401;
}
server {
  listen __PORT__;
  listen [::]:__PORT__;
  server_name test1.__DNSDOMAIN__ test2.__DNSDOMAIN__;
  root __TESTDIR__;

  # Uncomment this if you are running behind a reverse proxy and want
  # LemonLDAP::NG to see the real IP address of the end user
  # Adjust the settings to match the IP address of your reverse proxy
  # and the header containing the original IP address
  # As an alternative, you can use the PROXY protocol
  #
  #set_real_ip_from  127.0.0.1;
  #real_ip_header    X-Forwarded-For;

  # Internal authentication request
  location = /lmauth {
    internal;

    # FastCGI configuration
    include /etc/nginx/fastcgi_params;
    fastcgi_pass unix:__FASTCGISOCKDIR__/llng-fastcgi.sock;
    # Drop post datas
    fastcgi_pass_request_body  off;
    fastcgi_param CONTENT_LENGTH "";
    # Prevent attacks on older Nginx versions (<1.29.5)
    fastcgi_param HTTP_HOST $host;
    # Keep original request (LLNG server will receive /lmauth)
    fastcgi_param X_ORIGINAL_URI $original_uri;
    fastcgi_param UNIQUE_ID $request_id;
    # Improve performances
    #fastcgi_buffer_size 32k;
    #fastcgi_buffers 32 32k;
    

    # Or with uWSGI
    #include /etc/nginx/uwsgi_params;
    #uwsgi_pass 127.0.0.1:5000;
    # Drop post datas
    #uwsgi_pass_request_body  off;
    #uwsgi_param CONTENT_LENGTH "";
    # Prevent attacks on older Nginx versions (<1.29.5)
    # Do not set this line if your /etc/nginx/uwsgi_params contains already this line
    #uwsgi_param HTTP_HOST $host;
    # Keep original request (LLNG server will receive /lmauth)
    #uwsgi_param X_ORIGINAL_URI $original_uri;
    #uwsgi_param UNIQUE_ID $request_id;
    ## Improve performances
    #uwsgi_buffer_size 32k;
    #uwsgi_buffers 32 32k;
  }
  location @lmAuth401 {
      return 401;
  }

  # Client requests
  location / {
    # Local application
    index index.pl;
    try_files $uri $uri/ =404;

    # Reverse proxy
    #proxy_pass http://remote.server/;
    #include /etc/nginx/proxy_params;

    ##################################
    # CALLING AUTHENTICATION         #
    ##################################
    set $original_uri $uri$is_args$args;
    auth_request /lmauth;
    auth_request_set $lmremote_user $upstream_http_lm_remote_user;
    auth_request_set $lmremote_custom $upstream_http_lm_remote_custom;
    auth_request_set $lmlocation $upstream_http_location;
    # If CDA is used, uncomment this
    #auth_request_set $cookie_value $upstream_http_set_cookie;
    #add_header Set-Cookie $cookie_value;
    # Remove this for AuthBasic and OAuth2 handlers
    error_page 401 $lmerror_location;
    # Other error pages
    error_page 403 http://auth.__DNSDOMAIN__/lmerror/403;
    error_page 404 http://auth.__DNSDOMAIN__/lmerror/404;
    error_page 500 http://auth.__DNSDOMAIN__/lmerror/500;
    error_page 502 http://auth.__DNSDOMAIN__/lmerror/502;
    error_page 503 http://auth.__DNSDOMAIN__/lmerror/503;

    ##################################
    # PASSING HEADERS TO APPLICATION #
    ##################################

    # IF LUA IS SUPPORTED
    #include __CONFDIR__/nginx-lua-headers.conf;

    # ELSE
    # Set manually your headers
    #auth_request_set $authuser $upstream_http_auth_user;
    #proxy_set_header Auth-User $authuser;
    # OR in the corresponding block
    #fastcgi_param HTTP_AUTH_USER $authuser;

    # Then (if LUA is not supported), change cookie header to hide LLNG cookie
    #auth_request_set $lmcookie $upstream_http_cookie;
    #proxy_set_header Cookie $lmcookie;
    # OR in the corresponding block
    #fastcgi_param HTTP_COOKIE $lmcookie;

    # Set REMOTE_USER and REMOTE_CUSTOM (for FastCGI apps only)
    #fastcgi_param REMOTE_USER $lmremote_user;
    #fastcgi_param REMOTE_CUSTOM $lmremote_custom;
  }

  # Handle test CGI
  location ~ ^(?<sc>/.*\.pl)(?:$|/) {
    include /etc/nginx/fastcgi_params;
    fastcgi_pass unix:__FASTCGISOCKDIR__/llng-fastcgi.sock;
    fastcgi_param LLTYPE cgi;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_split_path_info ^(.*\.pl)(/.+)$;
    fastcgi_param REMOTE_USER $lmremote_user;
    fastcgi_param REMOTE_CUSTOM $lmremote_custom;

    # For managing logout_app / logout_app_sso redirection
    # Make sure the following block is enabled in the appropriate "location" section
    #header_filter_by_lua '
    #  if ngx.var["internal_lemonldap_logout_url"] ~= nil and ngx.var["internal_lemonldap_logout_url"] ~= "" then
    #    return ngx.exit(457)
    #  end
    #';
    # Do not drop upstream cookies for logout_app / logout_app_sso redirections
    #add_header Set-Cookie $upstream_http_set_cookie always;
    # Use specific code for triggering logout_app / logout_app_sso redirections
    #error_page 457 $internal_lemonldap_logout_url;

    # Or with uWSGI
    #include /etc/nginx/uwsgi_params;
    #uwsgi_pass 127.0.0.1:5000;
    #uwsgi_param LLTYPE cgi;
    #uwsgi_param SCRIPT_FILENAME $document_root$sc;
    #uwsgi_param SCRIPT_NAME $sc;
  }
}
