nginx site boilerplate

nginx_site_config

server {
	listen      443;
	listen      [::]:443;
	server_name example.com;

	ssl on;
	add_header Strict-Transport-Security "max-age=31536000" always;
	ssl_certificate     /etc/nginx/ssl/live/example.com/fullchain.pem; # <--
	ssl_certificate_key /etc/nginx/ssl/live/example.com/privkey.pem; # <--

	# https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
	ssl_prefer_server_ciphers on;
	ssl_session_cache shared:SSL:10m;
	# ssl_dhparam /etc/nginx/ssl/dhparam.pem;

	location / {
		proxy_set_header Accept-Encoding   ""; # no backend compression
		proxy_set_header Host              $http_host;
		proxy_set_header X-Real-IP         $remote_addr;
		proxy_set_header X-Forwarded-By    $server_addr:$server_port;
		proxy_set_header X_Forwarded_Proto https;
		proxy_set_header X-Forwarded-Ssl   on;
		proxy_set_header X-Forwarded-For   $remote_addr;
		proxy_pass       http://example-container;
	}
}

server {
	listen      80;
	listen      [::]:80;
	server_name example.com;

	location / {
		return 301 https://example.com$request_uri;
	}
}