Nginx reverse proxy

You can use the nginx.conf template below for a secure, https-only nginx reverse proxy for droppy. The aim of this setup is high security, and nginx 1.7 compiled with SPDY, SSL, and SNI (when running multiple domains). Make sure to use at least nginx 1.6, as previous versions have issues proxying websockets.

Replace USER with the user to run nginx with, DOMAIN with your domain, and DOMAINCERT, DOMAINKEY, CABUNDLE, DHPARAM with the absolute paths to these files utilized by TLS.

user                              USER;
worker_processes                  1;
error_log                         /var/log/nginx/error.log;
events {
    worker_connections            1024;
}
http {
    include                       mime.types;
    default_type                  application/octet-stream;
    server_tokens                 off;
    sendfile                      on;
    keepalive_timeout             180;
    client_max_body_size          0;
    upstream droppy {
        server                    127.0.0.1:8989;
    }
    server {
        listen                    80;
        server_name               DOMAIN;
        rewrite                   return 301 https://$host$request_uri;
    }
    server {
        listen                    443 ssl spdy;
        server_name               DOMAIN;
        access_log                /var/log/nginx/nginx.log;
        ssl_certificate           DOMAINCERT;
        ssl_certificate_key       DOMAINKEY;
        ssl_trusted_certificate   CABUNDLE;
        ssl_dhparam               DHPARAM;
        ssl_prefer_server_ciphers on;
        ssl_session_cache         shared:SSL:50m;
        ssl_session_timeout       5m;
        ssl_stapling              on;
        ssl_stapling_verify       on;
        resolver                  8.8.8.8;
        ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers               ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!CAMELLIA;
        location / {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Real-Port $remote_port;
            proxy_set_header Host $http_host;
            proxy_pass http://droppy/;
            proxy_redirect off;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            add_header Strict-Transport-Security "max-age=31536000";
        }
    }
}