editoria-debian-prod/assets/nginx-ssl.conf

server {
  listen 80;
  listen [::]:80;
  server_name editoria.figli.io;
  return 301 https://$server_name$request_uri;
}

server {
  listen 443 ssl;
  listen [::]:443 ssl;

  server_name editoria.figli.io;

  charset utf-8;

  location = /favicon.ico { access_log off; log_not_found off; }
  location = /robots.txt  { access_log off; log_not_found off; }

  access_log on;
  # error_log /var/logs/nginx/editoria.figli.io/error.log;

  sendfile off;

  client_max_body_size 100m;

  #SSL Certificates
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_certificate "/etc/letsencrypt/live/editoria.figli.io/fullchain.pem";
  ssl_certificate_key "/etc/letsencrypt/live/editoria.figli.io/privkey.pem";
  ssl_dhparam /etc/nginx/ssl/certs/editoria.figli.io/dhparam.pem;
  ssl_session_cache shared:SSL:1m;
  ssl_session_timeout 10m;
  ssl_ciphers HIGH:!aNULL:!MD5;
  #ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
  ssl_prefer_server_ciphers  on;

  add_header Strict-Transport-Security "max-age=31536000;
  #includeSubDomains" always;

  location ~ /\.ht {
    deny all;
  }

  location / {
    proxy_pass http://127.0.0.1:9005;
    proxy_set_header    Host $host;

    proxy_connect_timeout 30;
    proxy_send_timeout 30;
  }

  # website should not be displayed inside a <frame>, an <iframe> or an <object>
  add_header X-Frame-Options SAMEORIGIN;
}