Let's say I have two custom headers, `foo` and `bar` that contribute to the uniqueness of a REST query, how can I configure nginx to include these in its cache key?

For example we these queries that hit the same url but should be cached differently given their headers:

```
wget --header=foo:1 --header=bar:A http://my.web.site/api/query  
wget --header=foo:1 --header=bar:B http://my.web.site/api/query
wget --header=foo:2 --header=bar:A http://my.web.site/api/query  
wget --header=foo:2 --header=bar:B http://my.web.site/api/query

```
['https://serverfault.com/questions/1051688', 'https://serverfault.com', 'https://serverfault.com/users/679/']
Ok, so with help of [@Praveen Premaratne](https://serverfault.com/users/446078/praveen-premaratne) and [@Piotr P. Karwasz](https://serverfault.com/users/530633/piotr-p-karwasz) and this [article](http://dev.joget.org/community/display/DX7/NGINX+as+Proxy+to+Tomcat) I came up with following configuration:

> 
> don't put in lines with "# managed by Certbot", those are created by certbot, check <https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-18-04>
> 
> 
> 

**etc/nginx/sites-available/mydomain.com**

```
server {
    server_name    mydomain.com www.mydomain.com;

    root /var/www/mydomain.com;
    index index.html;

    access_log /var/log/nginx/mydomain-access.log;
    error_log /var/log/nginx/mydomain-error.log;

    location / {
        try_files $uri $uri/ /index.html;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = www.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    if ($host = mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name    mydomain.com www.mydomain.com;
    listen 80;
    return 404; # managed by Certbot
}

```

**/etc/nginx/sites-available/api.mydomain.com**

```
server {
    server_name    api.mydomain.com;

    access_log /var/log/nginx/api-mydomain-access.log;
    error_log /var/log/nginx/api-mydomain-error.log;

    location / {
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://127.0.0.1:8080;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}

server {
    if ($host = api.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    server_name    api.mydomain.com;
    listen 80;
    return 404; # managed by Certbot
}

```

**Tomcat server.xml**

```
<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
    connectionTimeout="20000"
    address="127.0.0.1"
    proxyName="api.mydomain.com"
    proxyPort="80"/>

<Engine name="Catalina" defaultHost="localhost">

    <Realm className="org.apache.catalina.realm.LockOutRealm">
    ...
    </Realm>

    <Host name="localhost"  appBase="webapps"
        unpackWARs="true" autoDeploy="true">

        <Valve className="org.apache.catalina.valves.RemoteIpValve"
            remoteIpHeader="x-forwarded-for"
            proxiesHeader="x-forwarded-by"
            protocolHeader="x-forwarded-proto" />

        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
            prefix="localhost_access_log" suffix=".txt"
            pattern="%h %l %u %t %r %s %b" />

  </Host>
</Engine>

```
If I were to do this using the subdomains approach here's how I would do it.

* Create an Nginx configuration file for the backend API
* Create an Nginx configuration file for the static web content

> 
> Static HTML Nginx file `mydomain.com.nginx`
> 
> 
> 

```
server {
    server_name    mydomain.com;

    root /var/www/mydomain.com;
    index index.html;

    access_log /var/log/nginx/mydomain-access.log;
    error_log /var/log/nginx/mydomain-error.log;

    location / {
        try_files $uri $uri/ /index.html;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/www.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen         80;
    server_name    mydomain.com;
    return 404; # managed by Certbot

}

```

> 
> API Nginx config file `api.mydomain.com.nginx`
> 
> 
> 

```
server {
    server_name    api.mydomain.com;

    access_log /var/log/nginx/api-mydomain-access.log;
    error_log /var/log/nginx/api-mydomain-error.log;

    location / {
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://127.0.0.1:8080;
        proxy_redirect off;
    }
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/api.mydomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/api.mydomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = api.mydomain.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen         80;
    server_name    app.mydomain.com;
    return 404; # managed by Certbot

}

```

You can add these to the `/etc/nginx/site-available/` directory and enable them.

*Ps: I would remove the SSL stuff and run Certbot to update them since you've to issue a new certificate for the **app.mydomain.com**, so it would just update the files itself*