httpd_can_network_connect must be set at True to allow nginx to connect to other network sockets, and act as an HTTP proxy.

This should be added to the paas-docker role for the nginx front-end.

See b97c394f for a sample with cmd.run or Salt documentation for a sample with the SELinux states.