DISCLAIMER: Please note that the configuration in this file does NOT guarantee your server or service security. They are techniques and solutions which have been adopted and worked thus far in our environments. Remember that server attacks are complex, wide-ranging, and their prevention varies according to your specific environments and services…

deployd-ssl-spdy.conf

log_format https_requests '$remote_addr - [$time_local] "$request" $status "$request_body"';

server {

    listen 443 ssl spdy;
    server_name example.com;
    server_tokens off;


    # SSL Configuration
    # =================================

    ssl_certificate     /path/to/your/server.crt;
    ssl_certificate_key /path/to/your/server.key;

    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_trusted_certificate /path/to/your/trustchain.crt;
    resolver 8.8.8.8 8.8.4.4;

    keepalive_timeout 60;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA !eNULL ECDH+AESGCM ECDH+AES256 ECDH+AES128 DH+3DES !ADH !AECDHD ECDH+3DES H+AESGCM DH+AES256DH+AES RSA+AES RSA+3DES !MD5 !DSS RC4 HIGH !aNULL !MD5 !kEDH";


    # Set HSTS header to 12 months
    # =================================

    #add_header  Strict-Transport-Security "max-age=31536000; includeSubDomains";


    # Tell Node that the connection is secure
    # =================================

    proxy_read_timeout 5m;
    proxy_connect_timeout 5m;
    proxy_pass_header Server;
    proxy_set_header Host $host;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;


    # Needed to securely proxy Websocket requests
    # =================================

    proxy_http_version 1.1;
    proxy_cache_bypass $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Upgrade $http_upgrade;


    # SPDY + Headers
    # =================================

    add_header  Access-Control-Allow-Origin     *;
    add_header  Front-End-Https                 on;
    #add_header  Alternate-Protocol              443:npn-spdy/2;
    #add_header  Alternate-Protocol              443:npn-spdy/3;
    #add_header  Alternate-Protocol              443:npn-spdy/3.1;


    # Handle API EndPoints
    # =================================

    location / {

        # Define Custom logs (track all HTTPS requests)
        # =================================
        access_log /var/log/nginx/access.log;
        access_log /var/log/nginx/https_requests.log https_requests;

        proxy_redirect off;
        proxy_pass http://localhost:2403;
    }
    
    # Handle the Deployd Dashboard
    # =================================

    location ~ ^/(dashboard) {

        access_log /var/log/nginx/access.log;

        proxy_redirect off;
        proxy_pass http://localhost:2403;
    }
    
}