Permalink
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
64 lines (55 sloc) 1.96 KB
server {
listen 443 ssl http2;
server_name <%= domain.name %>;
ssl on;
ssl_certificate <%= domain.chained_cert_path %>;
ssl_certificate_key <%= domain.key_path %>;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_session_cache shared:SSL:50m;
ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
ssl_dhparam <%= dhparam_path %>;
# Prevent Nginx from leaking the first TLS config
if ($host != $server_name) {
return 444;
}
<% if domain.access_restriction %>
<% domain.access_restriction.each do |ip| %>
allow <%= ip %>;
<% end %>
deny all;
<% end %>
<% if domain.basic_auth_enabled? %>
auth_basic "Password";
auth_basic_user_file <%= domain.htaccess_path %>;
<% end %>
<% if domain.upstream %>
location / {
<% if ENV['DYNAMIC_UPSTREAM'] && ENV['DYNAMIC_UPSTREAM'].downcase == 'true' %>
set $backend <%= domain.upstream %>;
proxy_pass $backend;
<% else %>
proxy_pass <%= domain.upstream %>;
<% end %>
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
<% if ENV['WEBSOCKET'] && ENV['WEBSOCKET'].downcase == 'true' %>
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
proxy_read_timeout 2h;
<% end %>
}
<% elsif domain.redirect_target_url %>
location / {
return 301 https://<%= domain.redirect_target_url %>$request_uri;
}
<% else %>
location / {
root <%= domain.www_root %>;
index index.html;
}
<% end %>
}