nginx config for letsencrypt

upstream unicorn {
  server unix:/home/openfoodnetwork/apps/openfoodnetwork/shared/sock/unicorn.openfoodnetwork.sock fail_timeout=0;
}

server {
 listen 80;
 server_name  staging.usfoodcoop.org usfoodcoop.org;
 
# Do not use a /tmp folder or other users can obtain certificates.
    location '/.well-known/acme-challenge' { 
    default_type "text/plain";
    root        /etc/letsencrypt/webrootauth;
   }
    
    location / {
    rewrite ^/(.*) https://staging.usfoodcoop.org/$1 permanent;
    }
}

ssl_certificate      /etc/letsencrypt/live/staging.usfoodcoop.org/fullchain.pem;
ssl_certificate_key  /etc/letsencrypt/live/staging.usfoodcoop.org/privkey.pem;

server {
  listen 443 ssl;

  #include openfoodnetwork_ssl;

  server_name www.staging.usfoodcoop.org;
  rewrite ^(.*) https://staging.usfoodcoop.org/$1 permanent;
}

server {
  listen 443 ssl;
  server_name staging.usfoodcoop.org;
  root /home/openfoodnetwork/apps/openfoodnetwork/current/public;

  #include openfoodnetwork_ssl;


  try_files $uri/index.html $uri @unicorn;
  location @unicorn {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_redirect off;
    proxy_pass http://unicorn;
  }

  location ~ ^/(assets)/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
    #add_header Last-Modified "";
    #add_header ETag "";
  }
  error_page 500 502 503 504 /500.html;
  client_max_body_size 4G;
  keepalive_timeout 60;
}