events {}

http {
    map $http_authorization $is_valid_bearer {
        default                                 0;
        "Bearer kubevela-auth-test-token"       1;
    }

    server {
        listen 443 ssl;
        server_name chartmuseum-bearer.kubevela-auth-test.svc.cluster.local;

        ssl_certificate     /etc/nginx/certs/server.crt;
        ssl_certificate_key /etc/nginx/certs/server.key;

        location / {
            if ($is_valid_bearer = 0) {
                add_header WWW-Authenticate 'Bearer realm="kubevela-auth-test", error="invalid_token"' always;
                return 401 'invalid_token\n';
            }
            proxy_pass http://127.0.0.1:8080;
            proxy_set_header Host $host;
        }
    }
}