load-balancer.conf

worker_processes 4;
worker_rlimit_nofile 40000;

events {
    worker_connections 8192;
}

http {
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    upstream rancher_servers_http {
        least_conn; 
        server {IP}:80 max_fails=3 fail_timeout=5s;
    }

   upstream kubernetes-api {
        server {IP}:6443;
   }

   server {
        listen     6443 ssl http2;
        server_name apps.example.com;
        ssl_certificate /etc/nginx/ssl/tls.crt;
        ssl_certificate_key /etc/nginx/ssl/tls.key;
        location / {
            proxy_ssl_trusted_certificate /etc/nginx/rancher.crt;
            proxy_ssl_verify        off;
            proxy_pass https://kubernetes-api;
            proxy_set_header Host apps.example.com;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
   }

    server {
        listen     443 ssl http2;
        client_max_body_size 2G;
        # proxy_pass rancher_servers_https;
        server_name apps.example.com;
        ssl_certificate /etc/nginx/ssl/tls.crt;
        ssl_certificate_key /etc/nginx/ssl/tls.key;

        location / {
            proxy_pass https://{IP};
            proxy_ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
            proxy_ssl_ciphers             HIGH:!aNULL:!MD5;

            proxy_ssl_trusted_certificate /etc/nginx/rancher.crt;
            proxy_ssl_verify        off;

            proxy_set_header Host $host;
            #proxy_set_header Host apps.sub.example.com;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;

            add_header Access-Control-Allow-Origin "*";
            add_header Access-Control-Allow-Credentials true;
        }
    }

    server {
        listen 80;
        listen [::]:80;
        client_max_body_size 2G;
    }

    upstream rancher_servers_https {
        least_conn; 
        server {IP}:443 max_fails=3 fail_timeout=5s;
    }
    server {
        listen     443 ssl http2;
        client_max_body_size 2G;
        server_name *.example.com example.com
        # proxy_pass rancher_servers_https;
        ssl_certificate /etc/nginx/ssl/tls.crt;
        ssl_certificate_key /etc/nginx/ssl/tls.key;
    location / {
            proxy_pass                    https://rancher_servers_https;
            #proxy_ssl_certificate         /etc/nginx/ssl/tls.crt;
            #proxy_ssl_certificate_key     /etc/nginx/ssl/tls.key;
            proxy_ssl_protocols           TLSv1 TLSv1.1 TLSv1.2;
            proxy_ssl_ciphers             HIGH:!aNULL:!MD5;

            proxy_ssl_trusted_certificate /etc/nginx/workers.crt;
            proxy_ssl_verify        off;

            # proxy_ssl_verify_depth  2;
            # proxy_ssl_session_reuse on;

            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Port $server_port;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;

    }
    }
}