Nginx reverse proxy

You can use below nginx.conf template for a secure, https-only nginx reverse proxy for droppy. The aim of this setup is high security. nginx 1.8.0 or greater is recommended.

Replace USER with the user to run nginx with, DOMAIN with your domain, and CERT, KEY, CA, DHPARAM with the absolute paths to these files utilized by TLS.

user USER;
error_log /var/log/nginx/error.log;

events {
  worker_connections 1024;
  multi_accept on;
  use epoll;
}

http {
    include mime.types;
    default_type application/octet-stream;
    server_tokens off;
    sendfile on;
    keepalive_timeout 180;
    client_max_body_size 0;
    tcp_nopush on;
    tcp_nodelay on;

    upstream droppy {
        server 127.0.0.1:8989;
        keepalive 32;
    }
    server {
        listen 80;
        server_name DOMAIN;
        rewrite return 301 https://$host$request_uri;
    }
    server {
        listen 443 ssl;
        server_name DOMAIN;
        access_log /var/log/nginx/nginx.log;
        ssl_certificate CERT;
        ssl_certificate_key KEY;
        ssl_trusted_certificate CA;
        ssl_dhparam DHPARAM;
        ssl_prefer_server_ciphers on;
        ssl_session_cache shared:SSL:50m;
        ssl_session_timeout 5m;
        ssl_stapling on;
        ssl_stapling_verify on;
        resolver 8.8.8.8;
        ssl_protocols TLSv1.2;
        ssl_ciphers AES256+EECDH:AES256+EDH;
        location / {
            proxy_pass http://droppy/;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Real-Port $remote_port;
            proxy_set_header Host $http_host;
            proxy_redirect off;
            proxy_request_buffering off;
            proxy_http_version 1.1;
            proxy_cache off;
        }
    }
}