Load Balancer - Part 1 - NGiNX Setup

dummy-domain.com.conf

upstream dummy_domain_com {

  # HAProxy #
	server 10.0.0.1:8181;

}

proxy_cache_path 		            /mnt/nginx/cache levels=1:2 keys_zone=STATIC:10m inactive=24h max_size=256m;

server {

    listen                    	80;
    listen                    	[::]:80;
    server_name               	dummy-domain.com www.dummy-domain.com;
    return                    	301 https://dummy-domain.com$request_uri;
    server_tokens 		          off;

}

server {

    listen 			                443 ssl http2;
    listen 			                [::]:443 ssl http2;
    server_name 		            dummy-domain.com;
    server_tokens 		          off;

    ssl 			                  on;
    ssl_certificate 		        /etc/letsencrypt/live/dummy-domain.com/fullchain.pem;
    ssl_certificate_key 	      /etc/letsencrypt/live/dummy-domain.com/privkey.pem;
    ssl_dhparam 		            /etc/ssl/certs/dhparam.pem;
    ssl_session_timeout 	      60m;
    ssl_session_cache 		      shared:SSL:20m;
    ssl_session_tickets 	      on;
    ssl_session_ticket_key 	    /etc/ssl/tickets/dummy-domain.com/ticket.key;
    ssl_protocols               TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers 	on;
    ssl_ecdh_curve 		          secp384r1;
    ssl_ciphers 		            'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
    ssl_stapling 		            on;
    ssl_stapling_verify 	      on;

    resolver 			              8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 		        5s;

    add_header 			            Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
    add_header 			            X-Frame-Options DENY;
    add_header 			            X-Content-Type-Options nosniff;
    add_header 			            X-XSS-Protection "1; mode=block";

    access_log 			            /var/log/nginx/dummy-domain.com/access.log main;
    error_log 			            /var/log/nginx/dummy-domain.com/error.log;

    gzip 			                  on;
    gzip_disable 		            "msie6";
    gzip_vary 			            on;
    gzip_proxied 		            any;
    gzip_comp_level             9;
    gzip_buffers 		            16 8k;
    gzip_http_version 		      1.1;
    gzip_min_length             256;
    gzip_types 			            text/plain
				                        text/css
				                        text/xml
				                        text/javascript
				                        text/x-component
				                        application/json
				                        application/javascript
				                        application/x-javascript
				                        application/xml
				                        application/xml+rss
				                        application/vnd.ms-fontobject
				                        application/x-font
				                        application/x-font-opentype
				                        application/x-font-otf
				                        application/x-font-truetype
				                        application/x-font-ttf
				                        font/otf
				                        font/ttf
				                        font/opentype
				                        font/truetype
				                        image/svg+xml
				                        image/x-icon;

    location / {

	      # Backend servers #
        proxy_pass 		          http://dummy_domain_com/;
	      proxy_set_header        Host $http_host;
        proxy_set_header 	      X-Real-IP $remote_addr;
        proxy_set_header 	      X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header 	      X-Forwarded-SSL on;
	      proxy_set_header       	X-Forwarded-Proto https;

	      proxy_redirect        	default;
	      proxy_redirect        	http://$host/ https://$host/;
	      proxy_redirect        	http://hostname/ https://$host/;
	      proxy_read_timeout    	15s;
	      proxy_connect_timeout 	15s;

	      # Caching #
        proxy_buffering        	on;
        proxy_cache            	STATIC;
        proxy_cache_valid      	200  1d;
        proxy_cache_use_stale  	error timeout invalid_header updating http_500 http_502 http_503 http_504;

    }

}