Aleks,

How does this look?
server {
listen *:443 ssl;
server_name ~^(?<prefix>rwa|m2m|dwa)-(?<routing_key>\w+)-(\w+)\.(?<domain>(diasranch.net))(:\d+)?$;
proxy_read_timeout 86400s;
proxy_buffering off;
#access_log /logs/ssl_access.log;
error_log /logs/ssl_error.log error;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES12
8-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECD
SA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA3
84:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECD
HE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AE
S128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
ssl_certificate /etc/pki/tls/certs/star.domain.crt;
ssl_certificate_key /etc/pki/tls/private/star.domain.pem;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_prefer_server_ciphers on;
set $rhc_ip '';
rewrite_by_lua '
local finder = require "host_finder"
ngx.var.iot_ip = finder.findHost(ngx.var.routing_key, ngx.var.domain)
';
location /
rewrite ^(/ws/v[1-9]/dias/[^+]*)\+([^+]*)$ https://$prefix/$1\%2B$2 redirect;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_pass https://$iot_ip:443;
}
}