Configuration of nginx reverse proxy for gold/ghost on c3b.info

c3b.info.conf

upstream ghost_upstream {
    	server 127.0.0.1:2368;
    	keepalive 64;
}

server {

	listen 80;
	listen [::]:80;

	server_name c3b.info www.c3b.info;
    	return 301 https://$host$request_uri;
}

server {
    	listen 443 ssl http2;
    	listen [::]:443 ssl http2;

    	ssl_certificate /.../fullchain.pem;
    	ssl_certificate_key /.../privkey.pem;
    	ssl_session_timeout 1d;
    	ssl_session_cache shared:SSL:50m;
    	ssl_session_tickets off;

    	ssl_dhparam /.../dhparam.pem;

    	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    	ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    	ssl_ecdh_curve secp384r1;
    	ssl_prefer_server_ciphers on;

    	add_header Strict-Transport-Security max-age=15768000;

   	  ssl_stapling on;
    	ssl_stapling_verify on;

    	ssl_trusted_certificate /.../chain.pem;

    	resolver 8.8.8.8 8.8.4.4;

	    add_header X-Cache $upstream_cache_status;

	    root /var/www/html;

	location ~ /.well-known {
                allow all;
        }

	location / {
        	proxy_cache STATIC;
        	proxy_cache_valid 200 30m;
        	proxy_cache_valid 404 1m;
        	proxy_pass http://ghost_upstream;
        	proxy_ignore_headers X-Accel-Expires Expires Cache-Control;
        	proxy_ignore_headers Set-Cookie;
        	proxy_hide_header Set-Cookie;
        	proxy_hide_header X-powered-by;
        	proxy_set_header X-Real-IP $remote_addr;
        	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        	proxy_set_header Host $http_host;
        	expires 10m;
    	}

	location ~ ^/(?:ghost|signout) {
        	proxy_set_header X-Real-IP $remote_addr;
        	proxy_set_header Host $http_host;
        	proxy_pass http://ghost_upstream;
        	add_header Cache-Control "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0";
    	}
}

nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
	worker_connections 768;
	# multi_accept on;
}

http {

	sendfile on;
	tcp_nopush on;
	tcp_nodelay on;
	keepalive_timeout 65;
	types_hash_max_size 2048;
	server_tokens off;

	server_names_hash_bucket_size 64;
	server_name_in_redirect off;

	include /etc/nginx/mime.types;
	default_type application/octet-stream;

	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
	ssl_prefer_server_ciphers on;
	
	access_log /var/log/nginx/access.log;
	error_log /var/log/nginx/error.log;

	proxy_cache_path /var/run/cache levels=1:2 keys_zone=STATIC:75m inactive=24h max_size=512m;

	include /etc/nginx/conf.d/*.conf;
	include /etc/nginx/sites-enabled/*;
}