-
Notifications
You must be signed in to change notification settings - Fork 0
/
https.nginx.conf
158 lines (126 loc) · 5.07 KB
/
https.nginx.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
worker_processes 1;
events { worker_connections 1024; }
http {
sendfile on;
upstream web {
server localhost:8080;
}
upstream api {
server localhost:8089;
}
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name domain.com api.domain.com;
location ^~ /.well-known/acme-challenge/ {
allow all;
default_type "text/plain";
root /usr/share/nginx/html;
}
location / {
return 301 https://$host$request_uri;
}
}
# https://domain.com;
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name domain.com;
server_tokens off;
ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/domain.com/chain.pem;
ssl_buffer_size 8k;
ssl_dhparam /etc/nginx/ssl/dhparam-2048.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_ecdh_curve secp384r1;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:30m;
ssl_session_tickets off;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8;
proxy_redirect off;
proxy_next_upstream error timeout;
proxy_next_upstream_timeout 1s;
location / {
proxy_pass http://web;
proxy_pass_header Set-Cookie;
proxy_connect_timeout 159s;
proxy_send_timeout 600;
proxy_read_timeout 600;
proxy_buffer_size 64k;
proxy_buffers 16 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
proxy_hide_header Vary;
proxy_ignore_headers Cache-Control Expires;
proxy_set_header Host $http_host;
proxy_set_header Accept-Encoding '';
proxy_set_header Referer $http_referer;
proxy_set_header Cookie $http_cookie;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
# Required for new HTTP-based CLI
proxy_request_buffering off;
}
}
# https://api.domain.com;
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name api.domain.com;
server_tokens off;
ssl_certificate /etc/letsencrypt/live/api.domain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/api.domain.com/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/api.domain.com/chain.pem;
ssl_buffer_size 8k;
ssl_dhparam /etc/nginx/ssl/dhparam-2048.pem;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_ecdh_curve secp384r1;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:30m;
ssl_session_tickets off;
# OCSP stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8;
proxy_redirect off;
proxy_next_upstream error timeout;
proxy_next_upstream_timeout 1s;
location / {
proxy_pass http://api;
proxy_pass_header Set-Cookie;
proxy_connect_timeout 159s;
proxy_send_timeout 600;
proxy_read_timeout 600;
proxy_buffer_size 64k;
proxy_buffers 16 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
proxy_hide_header Vary;
proxy_ignore_headers Cache-Control Expires;
proxy_set_header Host $http_host;
proxy_set_header Accept-Encoding '';
proxy_set_header Referer $http_referer;
proxy_set_header Cookie $http_cookie;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Scheme $scheme;
proxy_set_header X-Forwarded-Proto $scheme;
# Required for new HTTP-based CLI
proxy_request_buffering off;
}
}
}