Обратный прокси с HTTPS

Интернет ──443──▶ Nginx на хосте ──▶ 127.0.0.1:3100 ──▶ nginx в Docker Compose ──▶ веб и API

services:
  nginx:
    ports: !override
      - "127.0.0.1:3100:80"

WEB_DOMAIN=https://yahont.example.ru

apt update && apt install -y nginx certbot python3-certbot-nginx
mkdir -p /var/www/letsencrypt

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    listen 80;
    listen [::]:80;
    server_name yahont.example.ru;

    location /.well-known/acme-challenge/ {
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

ln -s /etc/nginx/sites-available/yahont.example.ru.conf /etc/nginx/sites-enabled/
nginx -t && systemctl reload nginx
certbot certonly --webroot -w /var/www/letsencrypt -d yahont.example.ru

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name yahont.example.ru;

    ssl_certificate     /etc/letsencrypt/live/yahont.example.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yahont.example.ru/privkey.pem;
    ssl_session_timeout 1d;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Не меньше MAX_ALLOWED_UPLOAD_SIZE_MB (по умолчанию 250).
    client_max_body_size 250m;

    location / {
        proxy_pass http://127.0.0.1:3100;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        # Долгие ответы моделей и исследования идут потоком.
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

nginx -t && systemctl reload nginx
curl -sI https://yahont.example.ru | head -3

echo 'deploy-hook = systemctl reload nginx' >> /etc/letsencrypt/cli.ini
systemctl status certbot.timer
certbot renew --dry-run

location ^~ /api/oauth-provider/ {
    return 404;
}