# Merge into your TLS virtual host. Supply your own certificate configuration.
# Checkout IDs identify payment requests: do not log them as access-log paths.
server {
    listen 443 ssl;
    server_name pay.example.com;
    ssl_certificate /etc/ssl/your-fullchain.pem;
    ssl_certificate_key /etc/ssl/your-private-key.pem;
    access_log off;

    location ~ ^/(pay/[^/]+(/request\.json)?|assets/pay\.(css|js)|payer-guide)$ {
        proxy_pass http://127.0.0.1:8787;
        proxy_set_header Host $host;
        proxy_set_header Authorization "";
    }
    location / { return 404; }
}