NGINX config for SSL with Let's Encrypt certs

nginx.conf

worker_processes 2;

events {
    worker_connections 1024;
}

upstream app {
	server 127.0.0.1:5000 fail_timeout=0;	
}


server {
   listen 80;
   listen [::]:80; 	
   server_name www.domain.com domain.com;
   return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
	
    server_name www.domain.com domain.com;
    add_header Set-Cookie "X-Think-Muthafucka=/21; HTTPOnly; Secure; SameSite=Strict";

    # cache path, until 2 sub-directories, verification-key cache/8MB, cache max-size
    proxy_cache_path /var/www/html/cache levels=1:2 keys_zone=app:8m max_size=50m;
    # cache only response 200 OK... for 3min.
    proxy_cache_valid 200 3m;

	ssl on;
	ssl_certificate      /etc/letsencrypt/live/www.domain.com/fullchain.pem;
    	ssl_certificate_key  /etc/letsencrypt/live/www.domain.com/privkey.pem;
  
  	# Improve HTTPS performance with session resumption
  	ssl_session_cache shared:SSL:10m;
  	ssl_session_timeout 10m;

	# Enable server-side protection against BEAST attacks
  	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_prefer_server_ciphers on;
	ssl_ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384";
  		
        # RFC-7919 recommended: https://wiki.mozilla.org/Security/Server_Side_TLS#ffdhe4096
        ssl_dhparam /etc/ssl/ffdhe4096.pem;
        ssl_ecdh_curve secp521r1:secp384r1;

    # Aditional Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    add_header X-Frame-Options DENY always;
    add_header X-Content-Type-Options nosniff always;
    add_header X-Xss-Protection "1; mode=block" always;

  	# Enable OCSP stapling 
	ssl_stapling on;
  	ssl_stapling_verify on;
  	ssl_trusted_certificate /etc/letsencrypt/live/www.domain.com/fullchain.pem;
  	resolver 1.1.1.1 1.0.0.1 [2606:4700:4700::1111] [2606:4700:4700::1001] valid=300s; # Cloudflare
  	resolver_timeout 5s;

    charset utf-8;
    error_page  404              /404.html;
	
    access_log  /var/log/nginx/access.log  main;
    error_log /var/log/nginx/error.log debug; 

	
    # Required for LE certificate enrollment using certbot
    location '/.well-known/acme-challenge' {
	default_type "text/plain";
	root /var/www/html;
    }
	
    location / {
        proxy_set_header Host $host:$server_port;
	proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;
        proxy_redirect http:// https://;
	proxy_pass http://app:5000;
	
	proxy_http_version 1.1;
        proxy_request_buffering off;
        proxy_buffering off;
	
	proxy_cache app;
        add_header X-Proxy-Cache $upstream_cache_status;
 
	try_files $uri $uri/ /index.php?$args;
	root /var/www/html;
    }
	
    location ~ \.php$ {
            if (!-f $request_filename) { return 404; }
            expires                 epoch;
            include                 /etc/nginx/fastcgi_params;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_index           index.php;
            fastcgi_pass            unix:/run/php/php7.3-fpm.sock;

            fastcgi_param SCRIPT_FILENAME $request_filename;
        }

    location ~ \.(jpg|jpeg|gif|png|ico)$ {
            access_log      off;
            expires         33d;
	    add_header Cache-Control "public";
        }
	
    location ~ /\.ht {
        deny  all;
    }
    location ~ /\.env {
	deny all;
    }

}