( nginx-wordpress-docker/default.conf ) replacement

default.conf

server {
    listen         80;
    return 301 https://calendar.greenpeace.org.nz$request_uri;
}

server {
    listen 443 ssl;
    server_name calendar.greenpeace.org.nz;

    root /var/www/html;

    client_max_body_size 64m;

    index index.php;

	  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	  ssl_prefer_server_ciphers on;
	  ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";

	  ssl_ecdh_curve secp384r1;
  	ssl_session_cache shared:SSL:10m;
  	ssl_session_tickets off;
  	ssl_stapling on; 
  	ssl_stapling_verify on;
  	ssl_session_timeout 5m;

    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    ssl_certificate /etc/letsencrypt/live/calendar.greenpeace.org.nz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/calendar.greenpeace.org.nz/privkey.pem;

  	resolver $DNS-IP-1 $DNS-IP-2 valid=300s;
  	resolver_timeout 5s;
	  add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
	  add_header X-Frame-Options DENY;
	  add_header X-Content-Type-Options nosniff

    include global/restrictions.conf;
    include global/wordpress.conf;
}