events {
  worker_connections  1024;
}

http {
    # Redirect all incoming grpc-web requests to the LiT proxy. Everything else
    # goes directly to the internal lnd container. We use a temporary variable
    # here so we can rewrite it to the actual host again in the next map
    # directive.
    map $content_type $tmp_backend {
      "application/grpc-web+proto" "172.17.0.1:8443"; # LiT proxy.
      default "localhost:10009"; # main LND
    }

    # Streaming grpc-web requests can be identified by the
    # "Sec-WebSocket-Protocol: grpc-websockets" header field. So those requests
    # also need to go to the LiT proxy.
    map $http_sec_websocket_protocol $lnd_backend {
      "grpc-websockets" "172.17.0.1:8443"; # LiT proxy.
      default $tmp_backend; # Fall back to the value from the above map result.
    }

    # Make sure WebSockets are properly upgraded.
    map $http_sec_websocket_protocol $lnd_connection {
      "grpc-websockets" "upgrade";
      default $http_connection;
    }

    server {
        listen 80;
        server_name localhost;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Origin  https://$lnd_backend;
        proxy_set_header Connection $lnd_connection;

        location /lit {
            # This needs a slash at the end!
            proxy_pass https://172.17.0.1:8443/;
        }

        location ~* ^/(ln|loop|pool|lit)rpc\. {
            # This cannot have a slash at the end!
            proxy_pass https://$lnd_backend;
        }
    }
}