00-nginx.conf

esa@nginx /etc/nginx $ cat nginx.conf 
#
# This file is managed by puppet
#

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format custom   '$remote_addr $http_x_forwarded_for $remote_user '
                        '[$time_local] $http_host '
                        '"$request_method $scheme://$host$request_uri $server_protocol" '
                        '$status $body_bytes_sent $request_time '
                        '"$http_referer" "$http_user_agent"';

    access_log  /var/log/nginx/access.log  custom;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;
}

conf.d-gitlab.conf

server {
        listen 443 ssl;
        server_name gitlab.esav.fi;

        location / {
                proxy_pass http://gitlab.tre.esav.fi/;
                proxy_set_header Accept-Encoding "";

                proxy_set_header        Host $host:$server_port;
                proxy_set_header        X-Real-IP $remote_addr;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto https;
                proxy_redirect http:// https://;
        }

        ssl_certificate /etc/letsencrypt/live/gitlab.esav.fi/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/gitlab.esav.fi/privkey.pem;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;
        #ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:
ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:
!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_session_timeout 1d;
        #ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;

        # Increase max body size to work with git
        client_max_body_size 50m;



}

server {
        listen 80;
        server_name gitlab.esav.fi;

        include letsencrypt.conf;

        location /.well-known {
                alias /usr/share/nginx/html/.well-known;
        }

        location / {
                return 301 https://$host$request_uri;
        }

}

conf.d-riot.conf

server {                                                                       
        listen 443 ssl;                                                        
        server_name riot.esav.fi;                                              
                                                                               
        location / {                                                           
                proxy_pass http://matrix.tre.esav.fi:80/;                      
                proxy_redirect default;                                        
        }                                                                      
                                                                               
        ssl_certificate /etc/letsencrypt/live/riot.esav.fi/fullchain.pem;      
        ssl_certificate_key /etc/letsencrypt/live/riot.esav.fi/privkey.pem;    
                                                                               
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;                                   
        ssl_prefer_server_ciphers on;                                          
        #ssl_dhparam /etc/ssl/certs/dhparam.pem;
        ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:
ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:
!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
        ssl_session_timeout 1d;
        #ssl_session_cache shared:SSL:50m;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header Strict-Transport-Security max-age=15768000;
}

server {
        listen 80;
        server_name riot.esav.fi;

        include letsencrypt.conf;

        location /.well-known {
                alias /usr/share/nginx/html/.well-known;
        }

        location / {
                return 301 https://$host$request_uri;
        }

}