    server {
        listen 0.0.0.0:80;
        server_name _;

        proxy_set_header Cache-Control "no-cache, no-store";
        proxy_set_header Expires "0";
        proxy_set_header Pragma "no-cache";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header Cache-Control "no-cache, no-store";
        add_header Expires "0";
        add_header Pragma "no-cache";

        proxy_buffer_size          8k;

        # change location response header to https (prevents http redirect)
        proxy_redirect http:// https://;

        location / {
            proxy_pass http://127.0.0.1:8080;
        }

        location / {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location = /auth {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location = /auth/ {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location /auth/admin {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location /auth/admin/ {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location = /auth/admin/master/console {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location = /auth/admin/master/console/ {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location = /logout {
            proxy_pass http://127.0.0.1:8000;
        }

        location = /api/saml {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location ~ /api/saml/(.+) {
            allow 172.20.0.0/24;
            allow 10.48.0.0/24;
            #allow vpn1.ip.here;
            #allow vpn2.ip.here;
            deny all;
            proxy_pass http://127.0.0.1:8080;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location = /api/saml/client-redirect {
            proxy_pass http://127.0.0.1:8000;
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

        location = /api/users {
            proxy_pass http://127.0.0.1:8000;
            allow 172.20.0.0/8;
            allow 10.0.0.0/8;
            allow 192.10.0.0/16; 
            allow vpn1.ip.here;
            allow vpn2.ip.here;
            deny all;
            error_page 403 /usr/share/nginx/html/403.html;
            auth_basic "Restricted area";
            auth_basic_user_file /etc/nginx/.htpasswd;
        }

    }

	server_names_hash_bucket_size 64;
}
