unicorn - nginx - ssl

gistfile1.txt

upstream unicorn {
  server unix:/tmp/unicorn.bthlabs.sock fail_timeout=0;
}

server {
  listen 80 default_server;
  listen [::]:80 default_server ipv6only=on;
  # server_name example.com;
  root /index;

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

  location /faye {
       proxy_pass http://127.0.0.1:9292;
       proxy_http_version 1.1;
       proxy_set_header Host $host;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header X-Real-IP $remote_addr;
       proxy_set_header Upgrade $http_upgrade;
       #proxy_set_header Connection "upgrade";
       proxy_buffering off;
       proxy_redirect off;
       proxy_connect_timeout      90;
       proxy_send_timeout         90;
       proxy_read_timeout         90;
       proxy_set_header X-Forwarded-Proto https;
       break;
    }

  try_files $uri/index.html $uri @unicorn;
  location @unicorn {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    #proxy_set_header X-Forwarded-Proto https;
    #proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://unicorn;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 4G;
  keepalive_timeout 10;
  #proxy_set_header X-Forwarded-Proto $scheme

}

server {
  listen 443 ssl;
  ssl on;
  ssl_certificate /path_to.crt;
  ssl_certificate_key /path_to.key;

  #enables all versions of TLS, but not SSLv2 or 3 which are weak and now deprecated.
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

  # Make site accessible from http://localhost/
  server_name domain.com;

  try_files $uri/index.html $uri @unicorn;
  location @unicorn {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_pass http://unicorn;
  }

  root /index;

  location ^~ /assets/ {
    gzip_static on;
    expires max;
    add_header Cache-Control public;
  }

}