Nginx reverse proxy

You can use below nginx.conf template for a secure, https-only nginx reverse proxy for droppy. The aim of this setup is high security. nginx 1.8.0 or greater is recommended.

Replace USER with the user to run nginx with, DOMAIN with your domain, and CERT, KEY, CA, DH with absolute paths to these TLS files.

user USER;
error_log /var/log/nginx/error.log;

events {
  worker_connections 1024;
  multi_accept on;
  use epoll;
}

http {
  include mime.types;
  default_type application/octet-stream;
  server_tokens off;
  keepalive_timeout 180;
  client_max_body_size 0;
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;

  upstream droppy {
    server 127.0.0.1:8989;
    keepalive 32;
  }

  server {
    listen 80;
    server_name DOMAIN;
    rewrite return 301 https://$host$request_uri;
  }

  server {
    listen 443 ssl;
    server_name DOMAIN;
    access_log /var/log/nginx/nginx.log;
    ssl_certificate CERT;
    ssl_certificate_key KEY;
    ssl_trusted_certificate CA;
    ssl_dhparam DH;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:50m;
    ssl_session_timeout 5m;
    ssl_stapling on;
    ssl_stapling_verify on;
    ssl_protocols TLSv1.2;
    ssl_ciphers AES256+EECDH:AES256+EDH;
    resolver 8.8.8.8;

    location / {
      proxy_pass http://droppy/;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_set_header Host $http_host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Real-Port $remote_port;
      proxy_http_version 1.1;
      proxy_cache off;
      proxy_buffering off;
      proxy_redirect off;
      proxy_request_buffering off;
      proxy_buffer_size 64k;
      proxy_buffers 8 32k;
      proxy_ignore_client_abort on;
      proxy_connect_timeout 86400;
      proxy_read_timeout 86400;
      proxy_send_timeout 86400;
    }
  }
}