Nginx reverse proxy

You can use the nginx.conf template below for a secure, https-only reverse proxy for droppy.

Replace USER with the user to run nginx with, DOMAIN with your domain, and DOMAINCERT, DOMAINKEY, CABUNDLE, DHPARAM with the absolute paths to these files utilized by TLS.

user                              USER;
worker_processes                  1;
error_log                         /var/log/nginx/error.log;
events {
    worker_connections            1024;
}
http {
    include                       mime.types;
    default_type                  application/octet-stream;
    server_tokens                 off;
    sendfile                      on;
    keepalive_timeout             180;
    client_max_body_size          0;
    tcp_nodelay                   off;
    upstream node {
        server                    127.0.0.1:8989;
    }
    server {
        listen                    80;
        server_name               DOMAIN;
        rewrite                   ^ https://$server_name$request_uri? permanent;
    }
    server {
        listen                    443 ssl spdy;
        server_name               DOMAIN;
        access_log                /var/log/nginx/nginx.log;
        ssl_certificate           DOMAINCERT;
        ssl_certificate_key       DOMAINKEY;
        ssl_trusted_certificate   CABUNDLE;
        ssl_dhparam               DHPARAM;
        ssl_prefer_server_ciphers on;
        ssl_session_cache         shared:SSL:50m;
        ssl_session_timeout       5m;
        ssl_stapling              on;
        ssl_stapling_verify       on;
        resolver                  8.8.8.8;
        ssl_protocols             TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers               ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!CAMELLIA;
        location / {
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Real-Port $remote_port;
            proxy_set_header Host $http_host;
            proxy_pass http://node/;
            proxy_redirect off;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            add_header Strict-Transport-Security "max-age=31536000";
        }
    }
}