01-howto-setup-nginx-with-http2-on-ubuntu-12-04.md

The problem: old ubuntu does not support chrome http2 as chrome uses APLN which is exists in openssl ^1.0.2h

create file /etc/apt/sources.list.d/nginx.list and add lines

deb http://nginx.org/packages/mainline/ubuntu/ trusty nginx
deb-src http://nginx.org/packages/mainline/ubuntu/ trusty nginx

sudo -s
wget -q -O- http://nginx.org/keys/nginx_signing.key | sudo apt-key add -
apt-get update
apt-get install nginx
apt-get -y install build-essential libpcre3 libpcre3-dev zlib1g-dev checkinstall
apt-get build-dep nginx
wget https://www.openssl.org/source/openssl-1.0.2h.tar.gz
wget http://nginx.org/download/nginx-1.11.2.tar.gz
tar -xzvf nginx-1.11.2.tar.gz
tar -xzvf openssl-1.0.2h.tar.gz
cd nginx-1.11.2
./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --user=nginx --group=nginx --with-http_ssl_module --with-http_realip_module --with-http_addition_module --with-http_sub_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_random_index_module --with-http_secure_link_module --with-http_stub_status_module --with-http_auth_request_module --with-http_xslt_module=dynamic --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_perl_module=dynamic --with-threads --with-stream --with-stream_ssl_module --with-http_slice_module --with-mail --with-mail_ssl_module --with-file-aio --with-ipv6 --with-http_v2_module --with-cc-opt='-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,--as-needed' --with-openssl=/opt/install/openssl-1.0.2h
sudo checkinstall --pkgname=nginx --pkgversion=1.11.2 --nodoc
dpkg -i /opt/install/nginx-1.11.2/nginx_1.10.0-1_amd64.deb

sudo service nginx stop
kill -9 $(ps aux | grep 'nginx' | awk '{print $2}')
sudo service nginx start

02-fast-and-dirty-config

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    # Redirect all HTTP requests to HTTPS with a 301 Moved Permanently response.
    return 301 https://$host$request_uri;
}

server {
 listen 443 ssl http2;
 listen [::]:443 ssl http2;

 # certs sent to the client in SERVER HELLO are concatenated in ssl_certificate
 ssl_certificate /etc/nginx/ssl/cert.pem;
 ssl_certificate_key /etc/nginx/ssl/key.pem;
 ssl_session_timeout 1d;
 ssl_session_cache shared:SSL:50m;
 ssl_session_tickets off;

 # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
 ssl_dhparam /etc/nginx/ssl/dhparam.pem;

 # intermediate configuration. tweak to your needs.
 ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
 ssl_prefer_server_ciphers on;

 # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
 add_header Strict-Transport-Security max-age=15768000;

 # OCSP Stapling ---
 # fetch OCSP records from URL in ssl_certificate and cache them
 #  ssl_stapling on;
 # ssl_stapling_verify on;

 ## verify chain of trust of OCSP response using Root CA and Intermediate certs
 # ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

 resolver 8.8.4.4;

    location / {
      proxy_cache meteor;
      add_header X-Cache-Status $upstream_cache_status;
      add_header 'Access-Control-Allow-Origin' * always;
      add_header 'Access-Control-Allow-Methods' 'POST,PUT,DELETE,GET,OPTIONS' always;
      add_header 'Access-Control-Allow-Headers' 'Authorization,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
      proxy_pass http://127.0.0.1:3084/;
      proxy_cache_key "$scheme$proxy_host$request_uri";
    }
}