nginx.template

worker_processes 1;
 
events { worker_connections 1024; }
 
http {
    sendfile on;
    server_tokens off; 

    gzip on;
    gzip_types text/plain
               text/xml
               text/css
               application/xml
               application/xhtml+xml
               application/rss+xml
               application/javascript
               application/x-javascript
               image/png
               image/gif
               image/jpeg;


    upstream app_servers {
        server ${LINK_NAME};
    }

    server {
        listen *:443 ssl http2;

        ssl_certificate      /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
        ssl_certificate_key  /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
        ssl_protocols TLSv1.3 TLSv1.2 TLSv1.1 TLSv1;
        ssl_prefer_server_ciphers on;
        ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";
        
        add_header Strict-Transport-Security "max-age=15768000; includeSubdomains";
        add_header X-Frame-Options SAMEORIGIN;
        add_header X-XSS-Protection "1; mode=block";
        add_header X-Content-Type-Options nosniff;

        location / {
            proxy_pass         http://app_servers;
            proxy_redirect     off;
            proxy_set_header   Host $host;
            proxy_set_header   X-Real-IP $remote_addr;
            proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Host $server_name;
            limit_except GET POST PUT DELETE{
                deny all;
            }
        }
    }
}