| 1 | server {
|
|---|
| 2 |
|
|---|
| 3 | listen 443 ssl http2;
|
|---|
| 4 |
|
|---|
| 5 | server_name somewebsite.com;
|
|---|
| 6 |
|
|---|
| 7 | server_tokens off;
|
|---|
| 8 |
|
|---|
| 9 | access_log /var/log/nginx/somewebsite.com.access;
|
|---|
| 10 | error_log /var/log/nginx/somewebsite.com.error error;
|
|---|
| 11 |
|
|---|
| 12 | ssl on;
|
|---|
| 13 | ssl_protocols TLSv1.2;
|
|---|
| 14 | ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !NULL !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";
|
|---|
| 15 | ssl_prefer_server_ciphers on;
|
|---|
| 16 |
|
|---|
| 17 | ssl_buffer_size 16k;
|
|---|
| 18 | ssl_session_timeout 10m;
|
|---|
| 19 | ssl_session_cache builtin:1000 shared:SSL:10m;
|
|---|
| 20 | ssl_verify_client off;
|
|---|
| 21 | ssl_stapling on;
|
|---|
| 22 | ssl_stapling_verify on;
|
|---|
| 23 | resolver 8.8.8.8 8.8.4.4;
|
|---|
| 24 |
|
|---|
| 25 | ssl_trusted_certificate /etc/nginx/conf/ssl.crt/somewebsite.com.crt;
|
|---|
| 26 | ssl_certificate /etc/nginx/conf/ssl.crt/somewebsite.com.crt;
|
|---|
| 27 | ssl_certificate_key /etc/nginx/conf/ssl.key/somewebsite.com.key;
|
|---|
| 28 | ssl_dhparam /etc/nginx/conf/ssl.dhp/dynamic.dhparam.somewebsite.com.crt;
|
|---|
| 29 |
|
|---|
| 30 | location / {
|
|---|
| 31 |
|
|---|
| 32 | etag on;
|
|---|
| 33 | gzip on;
|
|---|
| 34 | gzip_disable "msie6";
|
|---|
| 35 | gzip_vary on;
|
|---|
| 36 | gzip_proxied any;
|
|---|
| 37 | gzip_comp_level 9;
|
|---|
| 38 | gzip_buffers 16 8k;
|
|---|
| 39 | proxy_http_version 1.1;
|
|---|
| 40 | gzip_http_version 1.1;
|
|---|
| 41 | gzip_min_length 256;
|
|---|
| 42 | gzip_types
|
|---|
| 43 | application/javascript
|
|---|
| 44 | application/json
|
|---|
| 45 | application/x-javascript
|
|---|
| 46 | application/xml
|
|---|
| 47 | application/xml+rss
|
|---|
| 48 | application/pdf
|
|---|
| 49 | image/jpeg
|
|---|
| 50 | image/png
|
|---|
| 51 | text/css
|
|---|
| 52 | text/javascript;
|
|---|
| 53 |
|
|---|
| 54 | # add_header Cache-Control: max-age=2592000;
|
|---|
| 55 | # add_header Cache-Control: public;
|
|---|
| 56 | # add_header Cache-Control: "public, max-age=604800";
|
|---|
| 57 | add_header X-Cache-Status $upstream_cache_status;
|
|---|
| 58 |
|
|---|
| 59 | add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
|
|---|
| 60 | add_header X-Frame-Options DENY;
|
|---|
| 61 | add_header X-Content-Type-Options nosniff;
|
|---|
| 62 |
|
|---|
| 63 | proxy_set_header Host $host;
|
|---|
| 64 | proxy_set_header X-Real-IP $remote_addr;
|
|---|
| 65 | proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|---|
| 66 | proxy_set_header X-Forwarded-Server $host;
|
|---|
| 67 | proxy_set_header X-Forwarded-Proto $scheme;
|
|---|
| 68 |
|
|---|
| 69 | proxy_pass https://somewebsite.com:443;
|
|---|
| 70 | proxy_read_timeout 90;
|
|---|
| 71 |
|
|---|
| 72 | # 10.1.1.1 somewebsite.com # servername
|
|---|
| 73 | # Add the above line to /etc/hosts This is the IP of the WAP server that the proxy should be talking to.
|
|---|
| 74 | }
|
|---|
| 75 | }
|
|---|
| 76 |
|
|---|
