45 lines
1.5 KiB
Nginx Configuration File
45 lines
1.5 KiB
Nginx Configuration File
http {
|
|
include /etc/nginx/proxy.conf;
|
|
limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;
|
|
server_tokens off;
|
|
|
|
sendfile on;
|
|
keepalive_timeout 29; # Adjust to the lowest possible value that makes sense for your use case.
|
|
client_body_timeout 10; client_header_timeout 10; send_timeout 10;
|
|
|
|
upstream helloapp{
|
|
server localhost:5000;
|
|
}
|
|
|
|
server {
|
|
listen *:80;
|
|
add_header Strict-Transport-Security max-age=15768000;
|
|
return 301 https://$host$request_uri;
|
|
}
|
|
|
|
server {
|
|
listen *:443 ssl;
|
|
server_name example.com;
|
|
ssl_certificate /etc/ssl/certs/testCert.crt;
|
|
ssl_certificate_key /etc/ssl/certs/testCert.key;
|
|
ssl_protocols TLSv1.1 TLSv1.2;
|
|
ssl_prefer_server_ciphers on;
|
|
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
|
|
ssl_ecdh_curve secp384r1;
|
|
ssl_session_cache shared:SSL:10m;
|
|
ssl_session_tickets off;
|
|
ssl_stapling on; #ensure your cert is capable
|
|
ssl_stapling_verify on; #ensure your cert is capable
|
|
|
|
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
|
|
add_header X-Frame-Options DENY;
|
|
add_header X-Content-Type-Options nosniff;
|
|
|
|
#Redirects all traffic
|
|
location / {
|
|
proxy_pass http://helloapp;
|
|
limit_req zone=one burst=10 nodelay;
|
|
}
|
|
}
|
|
}
|