server {
    listen ${http_port};
%{ if tls ~}
    listen ${https_port} ssl;
    ssl_certificate /etc/ssl/certs/private/tls.crt;
    ssl_certificate_key /etc/ssl/certs/private/tls.key;
    ssl_protocols TLSv1.2 TLSv1.3;
%{ endif ~}
    server_name ${fqdn};
%{ if custom_snippet != "" ~}
${custom_snippet}
%{ endif ~}
%{ for l in locations ~}
    location ${l.path} {
        proxy_pass ${upstream};
        proxy_http_version 1.1;
%{ for k,v in l.headers ~}        
        proxy_set_header ${k} ${v};
%{ endfor ~}
    }
%{ endfor ~}
}