port-forwarding nginx config file for glassfish using let's encrypt ssl certificate

api.domain.tld.conf

upstream glassfish {
	server 127.0.0.1:8080 weight=100 max_fails=5 fail_timeout=5;
}

server {
	listen 80;
	server_name servername.tdl;
	return 301 https://$host$request_uri;
}

server {
	server_name servername.tdl;
	listen 443;

	ssl on;
	ssl_certificate /etc/letsencrypt/live/api.domain.tld/cert.pem;
	ssl_certificate_key /etc/letsencrypt/live/api.domain.tld/privkey.pem;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-RSA-RC4-SHA:AES128-GCM-SHA256:HIGH:!RC4:!MD5:!aNULL:!EDH:!CAMELLIA;
	ssl_prefer_server_ciphers on;

	ssl_session_cache    shared:SSL:10m;
	ssl_session_timeout  10m;

	ssl_session_tickets off;
	ssl_stapling on;
	ssl_stapling_verify on;

	add_header Strict-Transport-Security max-age=15638400;
	add_header X-Frame-Options DENY;
	add_header X-Content-Type-Options nosniff;

	proxy_set_header Host       $http_host;
	proxy_set_header X-Real-IP  $remote_addr;

	location / {
		# set the maximum timeout for the proxy before closing connection
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header Host $host;
		proxy_redirect http:// https://;
		add_header P3P 'CP = "ALL DSP COR PSAa PSDa OUR NOR ONL UNI COM NAV"';
		proxy_pass_header  Set-Cookie;
		proxy_pass_header  P3P;
		proxy_pass http://glassfish/;
	}

}