dhis2-ansible/nginx-https.conf at master · jackregnart/dhis2-ansible · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

upstream dhis {
  server localhost:8080 fail_timeout=0;
}

# HTTPS server
#
server {
  listen 443 ssl default deferred;
  listen [::]:443 ssl;
  server_name {{ ansible_host }};

  ssl on;
  ssl_certificate         /etc/letsencrypt/live/{{ ansible_host }}/fullchain.pem;
  ssl_certificate_key     /etc/letsencrypt/live/{{ ansible_host }}/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/{{ ansible_host }}/fullchain.pem;

  ssl_session_cache shared:SSL:50m;
  ssl_session_timeout 5m;
  ssl_stapling on;
  ssl_stapling_verify on;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

  ssl_dhparam /etc/nginx/dhparams.pem;
  ssl_prefer_server_ciphers on;

  location / {
    proxy_pass http://dhis;
    proxy_set_header  X-Real-IP  $remote_addr;
    proxy_set_header  X-Forwarded-For  $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;
    proxy_set_header  X-Forwarded-Proto $scheme;
    proxy_redirect off;
    proxy_read_timeout 300;
  }
}