login_authelia

http {
...
...
    ssl_certificate /etc/pki/tls/certs/server.crt;
    ssl_certificate_key /etc/pki/tls/private/server.key;
    ssl_session_cache builtin:1000 shared:SSL:10m;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
    ssl_prefer_server_ciphers on;

  server {
    listen 80 default_server;
    server_name login.nwk.jwm2.net;
    rewrite ^ https://$host$request_uri? permanent;
  }
  server {
    listen 443;
    server_name login.nwk.jwm2.net;

    set $backend "http://127.0.0.1:4221";
    ssl on;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN";
    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Original-URI $request_uri;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-Proto https;
        proxy_intercept_errors on;

        proxy_pass $backend;

            if ($request_method !~ ^(POST)$){
#              error_page 401 = /error/401;
#              error_page 403 = /error/403;
              error_page 404 = /error/404;
            }
    }
  }
}