My Nginx Reverse-Proxy Configuration
SHELL=/bin/sh | |
PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin | |
# Order of crontab fields | |
# min hour mday month wday command | |
0 0 * * 1 mkdir -p /tmp/letsencrypt && letsencrypt renew && service nginx reload | |
0 0 * * 4 openssl dhparam -out /usr/local/etc/nginx/dhparams.pem 2048 && service nginx reload |
location '/.well-known/acme-challenge' { | |
default_type "text/plain"; | |
root /tmp/letsencrypt; | |
} |
worker_processes 1; | |
events { | |
worker_connections 1024; | |
} | |
http { | |
sendfile on; | |
#tcp_nopush on; | |
keepalive_timeout 65; | |
server { | |
listen 80; | |
listen [::]:80; | |
include letsencrypt; | |
location / { | |
return 301 https://$host$request_uri; | |
} | |
} | |
# HTTPS server | |
# | |
server { | |
listen 443 ssl http2; | |
listen [::]:443 ssl http2; | |
server_name qwertyuiop.ninja; | |
ssl_certificate /usr/local/etc/letsencrypt/live/git.astro73.com/fullchain.pem; | |
ssl_certificate_key /usr/local/etc/letsencrypt/live/git.astro73.com/privkey.pem; | |
include tls; | |
location / { | |
proxy_pass http://172.28.9.3:3000; | |
} | |
} | |
} |
# From https://cipherli.st/ | |
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; | |
ssl_prefer_server_ciphers on; | |
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; | |
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 | |
ssl_session_cache shared:SSL:10m; | |
ssl_session_tickets off; # Requires nginx >= 1.5.9 | |
ssl_stapling on; # Requires nginx >= 1.3.7 | |
ssl_stapling_verify on; # Requires nginx => 1.3.7 | |
#resolver $DNS-IP-1 $DNS-IP-2 valid=300s; | |
#resolver_timeout 5s; | |
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; | |
#add_header X-Frame-Options DENY; | |
#add_header X-Content-Type-Options nosniff; | |
# Extra diffie-helmen stuff | |
ssl_dhparam /usr/local/etc/nginx/dhparams.pem; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment