nginx.conf

env JWT_SECRET;

worker_processes 1;

events { worker_connections 1024; }

http {
    sendfile on;
    lua_package_path '/opt/openresty/nginx/lua/?.lua;;';

    server {
        listen 80;

        location / {
            proxy_pass http://backend:5000/;
        }

        location /secure {
            access_by_lua '
                local jwt = require("nginx-jwt")
                jwt.auth()
            ';

            proxy_pass http://backend:5000/secure;
        }

        location /secure/admin {
            access_by_lua '
                local jwt = require("nginx-jwt")
                jwt.auth({
                    aud="^foo:",
                    roles=function (val) return jwt.table_contains(val, "marketing") end
                })
            ';

            proxy_pass http://backend:5000/secure/admin;
        }
    }
}