server {
    listen 443 ssl;
    http2 on;
    server_name backups.example.org;
    ssl_certificate /etc/ssl/backups.example.org.pem;
    ssl_certificate_key /etc/ssl/backups.example.org.key;
    add_header Strict-Transport-Security "max-age=63072000" always;

    # optional: let nginx or an auth proxy handle SSO
    # nginx needs to pass the admin token to avoid double login
    auth_basic "rusticlone";
    auth_basic_user_file /etc/nginx/rusticlone.htpasswd;

    location / {
        proxy_pass http://127.0.0.1:32110;
        proxy_set_header Host $host;
        # if omitted, users will be prompted to enter the admin token themselves
        proxy_set_header Authorization "Bearer <admin token>";
    }

    # alternative: serve rusticlone under /backups/ of an existing server
    # keep trailing slash here
    #location /backups/ {
    #    proxy_pass http://127.0.0.1:32110/;
    #    proxy_set_header Host $host;
    #    proxy_set_header Authorization "Bearer <admin token>";
    #    # omit trailing slash here
    #    proxy_set_header X-Forwarded-Prefix "/backups";
    #}
}