nginx.conf

http {

    client_max_body_size 10M;

    server {
        server_name tuna.cs.uwaterloo.ca;
        listen 80;

        location / { return 301 https://$host$request_uri; }
        location /.well-known/acme-challenge/ {
            root /var/www/certbot;
        }
    }
    server {
        server_name tuna.cs.uwaterloo.ca;
        listen 443 ssl;

        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
        ssl_certificate /etc/letsencrypt/live/tuna.cs.uwaterloo.ca/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/tuna.cs.uwaterloo.ca/privkey.pem;

        location /caspar { try_files $uri @appc; }
        location @appc {
            rewrite ^/caspar/?$ / break;

            # confirmation and reset links sent via email won't arrive with a /caspar referer.
            # Hence, we manually define CONFIRM_URL and RESET_URL as /caspar/(confirm,reset) in the caspar Flask app, and don't remove the /caspar prefix here.
            rewrite ^/caspar/(confirm|reset)(.*)$ /caspar/$1$2 break;
            rewrite ^/caspar/(.*)$ $1 break; # remove /caspar prefix before passing to caspar container
            include uwsgi_params;
            uwsgi_pass caspar:5000; 
        }

        location / { 
            # make sure requests coming from /caspar go to caspar and not cuizinart:
            if ($http_referer ~* ^.*tuna.cs.uwaterloo.ca/caspar.*$ ) {
                rewrite ^/(.*)$ /caspar/$1 last;
            }
            try_files $uri @app; 
        }
        location @app {
            include uwsgi_params;
            uwsgi_pass cuizinart:5000;
        }

    }    
}

events { worker_connections 1024; }