nginx.conf

events {
    worker_connections 1024;
}

stream {
    server {
        proxy_connect_timeout 300s;
        proxy_timeout 300s;
        listen 9443;
        proxy_pass tjzimmerman.dev:9443;
    }
    server {
        proxy_connect_timeout 300s;
        proxy_timeout 300s;
        listen 1194 udp;
        proxy_pass tjzimmerman.dev:1194;
    }
}

http {
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    ssl_certificate /cert/fullchain.pem;
    ssl_certificate_key /cert/privkey.pem;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;

    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name www.tjzimmerman.com;
        location / {
            proxy_pass http://tjzimmerman.dev:2000/;

            sub_filter </head>
            '<script language="javascript" src="/analytics.js"></script></head>';
            sub_filter_once on;
        }
    }

    server {
        listen 443 ssl;
        server_name tjzimmerman.com;
        location / {
            proxy_pass http://tjzimmerman.dev:2000/;

            sub_filter </head>
                '<script language="javascript" src="/analytics.js"></script></head>';
            sub_filter_once on;
        }
    }

    server {
        listen 443 ssl;
        server_name vpn.tjzimmerman.com;
        location / {
            proxy_pass https://tjzimmerman.dev:943;

            sub_filter </head>
                '<script language="javascript" src="/analytics.js"></script></head>';
            sub_filter_once on;
        }
    }
}