server {

    server_name HOST.DOMAIN.NAME;
    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    location / {
        satisfy any;
        allow 10.X.X.0/24;
        allow 10.X.X.0/24;
        deny all;
        auth_basic              "Restricted access";
        auth_basic_user_file    /etc/passwords/passwords;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Real-IP $remote_addr;
        proxy_headers_hash_max_size 512;
        proxy_headers_hash_bucket_size 128;
        proxy_pass http://INTERNAL_HOME_ASSISTANT_IP:8123;
        include proxy_params;
     }


    listen 443 ssl;

    ssl_certificate /etc/letsencrypt/live/HOST.DOMAIN.NAME/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/HOST.DOMAIN.NAME/privkey.pem; # managed by Certbot
}

server {
    if ($host = HOST.DOMAIN.NAME) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name HOST.DOMAIN.NAME;

}