Nginx help

worker_processes auto;

events {
    worker_connections  1024;
}

http {
    include       mime.types;

    log_format alogformat "$time_local [location: $location_path][http_origin: $http_origin][cors: $cors] $scheme://$host:$server_port$request_uri";

    error_log  /var/log/nginx/error.log debug;
    access_log /var/log/nginx/access.log alogformat;

    ssl_certificate     /etc/letsencrypt/live/example.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com-0001/privkey.pem;

    map $http_origin $cors {
        default "test";
        ~^https?://([a-z0-9]+[.])*example\.com(:[0-9]+)?/?$ "$http_origin";
        ~^http://localhost:(3000|8080)?/?$ "$http_origin";
    }

    server {
        server_name api.example.com;
        listen 443 ssl;

        location /api/ {
            set $location_path 'api';

            add_header 'Access-Control-Allow-Origin' $cors always;
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, PATCH, PUT, HEAD';
            add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,Accept';
            add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
            add_header 'Access-Control-Allow-Credentials' 'true';

            if ($request_method = 'OPTIONS') {
                add_header 'Access-Control-Max-Age' 1728000;
                add_header 'Content-Type' 'text/plain charset=UTF-8';
                add_header 'Content-Length' 0;

                return 204;
            }

            rewrite ^/api/(.*)$ /$1 break;

            proxy_set_header X-Real-IP         $remote_addr;
            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host  $host;
            proxy_set_header X-Forwarded-Port  $server_port;

            proxy_pass http://apiapp:8080;
        }
    }
}