nginx-ssl-reverse-proxy.md

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name example.co.id;

    return 301 https://example.co.id$request_uri;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server ipv6only=on;
    server_name example.co.id;

    ssl_certificate /etc/nginx/ssl/example.co.id/cert.pem; 
    ssl_certificate_key /etc/nginx/ssl/example.co.id/cert.key; 
    ssl_trusted_certificate /etc/nginx/ssl/example.co.id/cert.ca-bundle;

    include /etc/nginx/ssl/example.co.id/options-ssl-nginx.conf; 
    ssl_dhparam /etc/nginx/ssl/example.co.id/ssl-dhparams.pem; 

    if ($host = 'example.co.id') {
        return 301 https://example.co.id$request_uri;
    }

    charset utf-8;

    access_log off;
    error_log /var/log/nginx/frontend_proxy.error.log;

    gzip_vary off;

    #add_header Referrer-Policy "strict-origin-when-cross-origin";
    #add_header Strict-Transport-Security "max-age=31536000;" always;
    #add_header X-Content-Type-Options nosniff;
    #add_header X-Frame-Options SAMEORIGIN;
    #add_header X-Permitted-Cross-Domain-Policies "all";
    #add_header X-Xss-Protection "1; mode=block";
    
    location / {
        # Proxy pass to nuxt
        proxy_pass http://localhost:3000;
        
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host "example.co.id";
        proxy_set_header Host "example.co.id";
    }
}