server  {

  listen  443 ssl http2;

  server_name  somewebsite.com;

  server_tokens off;

  access_log /var/log/nginx/somewebsite.com.access;
  error_log /var/log/nginx/somewebsite.com.error error;

  ssl  on;
  ssl_protocols TLSv1.2;
  ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH EDH+aRSA !NULL !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";
  ssl_prefer_server_ciphers on;

  ssl_buffer_size 16k;
  ssl_session_timeout  10m;
  ssl_session_cache  builtin:1000  shared:SSL:10m;
  ssl_verify_client off;
  ssl_stapling on;
  ssl_stapling_verify on;
  resolver 8.8.8.8 8.8.4.4;

  ssl_trusted_certificate /etc/nginx/conf/ssl.crt/somewebsite.com.crt;
  ssl_certificate      /etc/nginx/conf/ssl.crt/somewebsite.com.crt;
  ssl_certificate_key  /etc/nginx/conf/ssl.key/somewebsite.com.key;
  ssl_dhparam  /etc/nginx/conf/ssl.dhp/dynamic.dhparam.somewebsite.com.crt;

  location / {

  etag on;
  gzip on;
  gzip_disable "msie6";
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 9;
  gzip_buffers 16 8k;
  proxy_http_version 1.1;
  gzip_http_version 1.1;
  gzip_min_length 256;
  gzip_types
        application/javascript
        application/json
        application/x-javascript
        application/xml
        application/xml+rss
        application/pdf
        image/jpeg
        image/png
        text/css
        text/javascript;

#        add_header Cache-Control: max-age=2592000;
#        add_header Cache-Control: public;
#        add_header Cache-Control: "public, max-age=604800";
        add_header X-Cache-Status $upstream_cache_status;

        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
        add_header X-Frame-Options DENY;
        add_header X-Content-Type-Options nosniff;

        proxy_set_header        Host $host;
        proxy_set_header        X-Real-IP  $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Server $host;
        proxy_set_header        X-Forwarded-Proto $scheme;

        proxy_pass  https://somewebsite.com:443;
        proxy_read_timeout  90;

# 10.1.1.1   somewebsite.com    # servername
# Add the above line to /etc/hosts  This is the IP of the WAP server that the proxy should be talking to.
  }
}

