server {

    listen 443 ssl;

    server_name vpn.example.com;


    ssl_certificate /etc/letsencrypt/live/vpn.example.com/fullchain.pem;

    ssl_certificate_key /etc/letsencrypt/live/vpn.example.com/privkey.pem;


    # Admin UI

    location /admin/ {

        proxy_pass https://127.0.0.1:943/admin/;

        proxy_ssl_verify off;

        proxy_http_version 1.1;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;

    }


    # Client UI

    location / {

        proxy_pass https://127.0.0.1:943/;

        proxy_ssl_verify off; # Ignore self-signed cert

        proxy_http_version 1.1;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_buffering off;

        proxy_set_header Upgrade $http_upgrade;

        proxy_set_header Connection "upgrade";

    }


}