nginx conf

## SSL Settings

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
ssl_dhparam /etc/ssl/certs/dhparam.pem;

add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

# Block pages from loading when they detect reflected XSS attacks
add_header X-XSS-Protection "1; mode=block";

## Proxy settings

proxy_redirect off;
proxy_http_version 1.1;

proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

# Force cookie rewrite with HttpOnly and secure flag
proxy_cookie_path / "/; secure; HttpOnly";