My Nginx Reverse-Proxy Configuration
|
SHELL=/bin/sh |
|
PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin |
|
# Order of crontab fields |
|
# min hour mday month wday command |
|
0 0 * * 1 mkdir -p /tmp/letsencrypt && letsencrypt renew && service nginx reload |
|
0 0 * * 4 openssl dhparam -out /usr/local/etc/nginx/dhparams.pem 2048 && service nginx reload |
|
location '/.well-known/acme-challenge' { |
|
default_type "text/plain"; |
|
root /tmp/letsencrypt; |
|
} |
|
worker_processes 1; |
|
|
|
events { |
|
worker_connections 1024; |
|
} |
|
|
|
|
|
http { |
|
sendfile on; |
|
#tcp_nopush on; |
|
|
|
keepalive_timeout 65; |
|
|
|
server { |
|
listen 80; |
|
listen [::]:80; |
|
|
|
include letsencrypt; |
|
location / { |
|
return 301 https://$host$request_uri; |
|
} |
|
} |
|
|
|
|
|
# HTTPS server |
|
# |
|
server { |
|
listen 443 ssl http2; |
|
listen [::]:443 ssl http2; |
|
server_name qwertyuiop.ninja; |
|
|
|
ssl_certificate /usr/local/etc/letsencrypt/live/git.astro73.com/fullchain.pem; |
|
ssl_certificate_key /usr/local/etc/letsencrypt/live/git.astro73.com/privkey.pem; |
|
|
|
include tls; |
|
|
|
location / { |
|
proxy_pass http://172.28.9.3:3000; |
|
} |
|
} |
|
|
|
} |
|
# From https://cipherli.st/ |
|
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; |
|
ssl_prefer_server_ciphers on; |
|
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; |
|
ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0 |
|
ssl_session_cache shared:SSL:10m; |
|
ssl_session_tickets off; # Requires nginx >= 1.5.9 |
|
ssl_stapling on; # Requires nginx >= 1.3.7 |
|
ssl_stapling_verify on; # Requires nginx => 1.3.7 |
|
|
|
#resolver $DNS-IP-1 $DNS-IP-2 valid=300s; |
|
#resolver_timeout 5s; |
|
|
|
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"; |
|
#add_header X-Frame-Options DENY; |
|
#add_header X-Content-Type-Options nosniff; |
|
|
|
# Extra diffie-helmen stuff |
|
ssl_dhparam /usr/local/etc/nginx/dhparams.pem; |
