nginx-letsencrypt-http2/nginx-secure.conf at master · jayaprad/nginx-letsencrypt-http2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
events { worker_connections 1024; }
http {
        server {
                listen 80;
                server_name ___my.example.com___;

                location /.well-known/acme-challenge {
                        proxy_pass http://___LETSENCRYPT_IP___:___LETSENCRYPT_PORT___;
                        proxy_set_header Host            $host;
                        proxy_set_header X-Forwarded-For $remote_addr;
                        proxy_set_header X-Forwarded-Proto https;
                }

                location / {
                        return         301 https://$server_name$request_uri;
                }

        }

        server {
                listen 443 ssl http2;
                server_name ___my.example.com___;

                ssl on;
                ssl_certificate /etc/letsencrypt/live/___my.example.com___/fullchain.pem;
                ssl_certificate_key /etc/letsencrypt/live/___my.example.com___/privkey.pem;
                ssl_session_timeout 5m;
                ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
                ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
                ssl_prefer_server_ciphers on;

                ssl_session_cache shared:SSL:10m;
                ssl_dhparam /etc/ssl/private/dhparams.pem;

                location /.well-known/acme-challenge {
                        proxy_pass http://___LETSENCRYPT_HTTPS_IP___:___LETSENCRYPT_HTTPS_PORT___;
                        proxy_set_header Host            $host;
                        proxy_set_header X-Forwarded-For $remote_addr;
                        proxy_set_header X-Forwarded-Proto https;
                }

                location / {
                        proxy_pass http://___APPLICATION_IP___:___APPLICATION_PORT___;
                        proxy_set_header Host            $host;
                        proxy_set_header X-Forwarded-For $remote_addr;
                }
        }
}